Add paged-KV block_table bounds check in mha_fwd_kvcache

[yunweili3]

Fixes #2709

Problem

In the paged KV cache path, the split-KV kernel
(compute_attn_1rowblock_splitkv) indexes the block table as:

block_table[n_block * kBlockN / page_block_size]

This index is bounded only by actual_seqlen_k, which in the kvcache path is
seqlens_k[b] + seqlen_knew. However, block_table only has
max_num_blocks_per_seq columns per sequence.

If a caller passes a cache_seqlens (or appends new keys) such that a sequence
length exceeds max_num_blocks_per_seq * page_block_size, the kernel reads
block_table out of bounds — there is no in-kernel check, so this is silent
memory corruption / undefined behavior rather than a clear error.

Fix

Validate the caller contract host-side in mha_fwd_kvcache. On the paged-KV
path only, check that

max(seqlens_k) + seqlen_knew  <=  max_num_blocks_per_seq * page_block_size

and raise a descriptive TORCH_CHECK error otherwise, telling the caller to
allocate more columns in block_table.

The check uses .max().item(), which forces a device→host sync, so it is gated
behind if (paged_KV) and only paid on the paged-KV path.

Tests

Adds test_flash_attn_kvcache_paged_block_table_bounds, covering:

• Cache-length overflow — cache_seqlens beyond capacity must raise.
• Appended-new-keys overflow — a full-at-capacity cache plus one appended
  key must raise.
• Positive control — exactly at capacity (no appended keys) must not raise
  and returns a valid, non-NaN output.

Changes

File	Change
csrc/flash_attn/flash_api.cpp	Host-side bounds check on the paged-KV path
tests/test_flash_attn.py	New regression test