Enable Spectre-mitigated MSVC libs for BinSkim builds

[tianleiwu]

Description

This updates the Windows BinSkim-compliant build flags so /Qspectre builds also link against the MSVC Spectre-mitigated CRT/STL static libraries. /Qspectre only affects ONNX Runtime's own object files; BinSkim BA2024 can still report violations when the default non-Spectre libcmt.lib, libcpmt.lib, or libvcruntime.lib are linked into the final binary.

Motivation and Context

Release validation reported BinSkim BA2024 (EnableSpectreMitigations) warnings for onnxruntime.dll even when ORT was built with --use_binskim_compliant_compile_flags. The warning identified MSVC runtime and STL static libraries as the non-mitigated modules. This change makes the build option select the Spectre-mitigated MSVC library directory when it is available from the Visual Studio toolset.

Key Changes

• Adds get_msvc_spectre_lib_dir() to locate %VCToolsInstallDir%\lib\spectre\<arch> for the target Windows architecture.
• Appends a quoted /LIBPATH:<spectre-lib-dir> linker flag whenever Windows BinSkim flags enable /Qspectre and AddressSanitizer is not enabled.
• Emits a warning when the Spectre-mitigated MSVC libraries cannot be found, with guidance to install the Visual Studio "C++ Spectre-mitigated libs" component.
• Preserves the existing ASAN behavior because ASAN libraries do not have Spectre-mitigated variants.

Testing

• python3 -m ruff check tools/ci_build/build.py
• python3 -m ruff format --check tools/ci_build/build.py

lintrunner -a tools/ci_build/build.py was also attempted. It found the repository config and applied no file changes, but the local environment could not execute the Ruff lintrunner adapters because python is not available on PATH; the direct python3 -m ruff checks above passed.