fix: prevent EXP negative dimension size_t cast out of bounds access

[Sakura-501]

Vulnerability

This PR fixes an out of bounds memory access in the EXP kernel caused by converting a negative flat_size into size_t without validation.

A malformed tensor shape such as [-1] can make MatchingFlatSize return a negative value. ExpEval then casts that signed value to size_t, which expands it into a huge unsigned element count. reference_ops::Exp trusts that count and iterates far beyond the real input and output buffers, which can cause out of bounds read and write, process crash, and memory corruption.

Root cause

• MatchingFlatSize can return a negative value for malformed tensor dimensions
• ExpEval did not reject negative flat_size
• the unchecked signed to unsigned conversion turned an invalid shape into a huge iteration bound
• the EXP reference kernel then used that corrupted bound for memory access

Fix

• add TF_LITE_ENSURE(context, flat_size >= 0) in ExpEval
• reject malformed negative flat sizes before the size_t cast
• keep the patch minimal and localized to the vulnerable path
• add one regression test that verifies a negative dimension now returns kTfLiteError instead of crashing

Why the fix is correct

The bug exists at the conversion boundary between signed and unsigned length handling. Rejecting negative flat_size values prevents the dangerous cast and stops malformed tensor shapes from reaching the out of bounds loop in reference_ops::Exp.

Local verification

• bazel test //tensorflow/lite/micro/kernels:exp_test
• xcrun clang-format --dry-run -Werror tensorflow/lite/micro/kernels/exp.cc tensorflow/lite/micro/kernels/exp_test.cc
• git diff --check
• bash tensorflow/lite/micro/tools/ci_build/test_code_style.sh

BUG=None