fix: escape attribute-based code injection vectors in C++ codegen (bypass of #8964 fix)

[adilburaksen]

Summary

The fix in #8964 (commit 8afb68f) patched code injection via string default values in FlatBuffers C++ codegen, but missed four additional injection vectors where attribute values are embedded verbatim into generated C++ source.

Affected vectors

Attribute	Embedding context	Injection risk
native_include	#include "..." path	" or newline closes the directive
native_type	C++ type name in typedefs/structs	}, ;, { break out of type context
cpp_type	C++ type name in member decls	Same as native_type
cpp_ptr_type_get	C++ method call expression	; injects additional statements

Reproduction (before this fix)

// native_type injection
table Foo (native_type: "Bar}; void evil(){") { x: int; }

Generated (pre-fix):

typedef Bar}; void evil(){ NativeTableType;  // arbitrary code injected

Fix

• IsValidCppTypeExpression(): allows only characters legal in a C++ type name ([A-Za-z0-9_::< >*& ,.()])) — rejects anything else.
• IsValidIncludePath(): rejects paths containing ", \n, or \r.
• ValidateAttributeSafety(): upfront validation pass at the start of generate() that checks native_type, cpp_type, and cpp_ptr_type_get on all struct/field definitions before any code is emitted.
• Inline check in GenIncludeDependencies() for each native_include path.

All four vectors now cause flatc to exit non-zero with a descriptive error message.

Test

tests/attribute_injection_test.fbs documents all four injection vectors (as comments, since they are expected to be rejected) and provides a safe-attribute baseline table that must continue to compile successfully.

Relationship to #8964

This PR is a targeted follow-up to #8964 covering the remaining injection surface in the C++ code generator. The same .fbs trust-boundary issue applies: a malicious or compromised .fbs schema processed by flatc can produce C++ source that executes attacker-controlled code when compiled and run.