fix(runtime): free custom AVIO buffers on all exits

[wangxiuwen]

What does this PR do?

Free the buffer owned by the custom AVIOContext on every exit from the in-memory FFmpeg loader.

The cleanup helper follows FFmpeg's custom-I/O example: close the format input first, free the context's current buffer, and then call avio_context_free. It deliberately reads avio_ctx->buffer at cleanup time because libavformat may replace the original buffer while probing.

Reference: https://ffmpeg.org/doxygen/trunk/avio_read_callback_8c-example.html

Why is this needed?

The error paths previously called only avio_context_free, which does not release the caller-supplied/current AVIO buffer. Every failed in-memory decode therefore leaked the copied input buffer. The success path also freed the context structure directly instead of using the public FFmpeg cleanup API.

Validation

• git diff --check
• Audited all seven error exits and the success exit in Audio::FfmpegLoad(const char*, int).
• Verified format cleanup precedes custom AVIO cleanup, matching the FFmpeg example.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[LauraGPT]

Validated the exact PR head together with #3448, #3449, and #3450 on current main in an isolated worktree.

• Full ONNX Runtime C++ build completed with FFmpeg enabled and AddressSanitizer instrumentation; all library, runtime binary, and OpenFST targets built successfully.
• An ASAN harness verified AudioFrame copy construction and assignment own independent sample buffers and preserve metadata.
• The same harness exercised the invalid-buffer FFmpeg cleanup path 1,000 times with leak detection enabled.
• No AddressSanitizer error or leak was reported.

The three patches touch separate ownership problems and merge cleanly as a set.