fix: patch llguidance to remove reference to ring crate

[sanaa-hamel-microsoft]

Fix MVS-2022-374v-6mvc by purging references to ring from Cargo.lock.

[sanaa-hamel-microsoft]

@microsoft-github-policy-service agree company="Microsoft"

[Copilot]

Pull request overview

This pull request addresses security vulnerability MVS-2022-374v-6mvc by removing references to the deprecated ring crate from the llguidance dependency's Cargo.lock file. The fix applies a patch at build time that comments out unused workspace members in llguidance that transitively depend on ring, ensuring component governance compliance.

Changes:

• Added a patch file that removes ring package entry from Cargo.lock and comments out workspace members (python_ext, sample_parser, json_stats, toktrie_hf_tokenizers, toktrie_hf_downloader, toktrie_tiktoken) that depend on ring
• Modified the CMake build script to apply the patch automatically when USE_GUIDANCE is enabled, using a marker file to ensure idempotent application

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
cmake/external/onnxruntime_external_deps.cmake	Added logic to apply a git patch to llguidance source after fetching, with idempotency check via marker file
cmake/external/llguidance/remove-ring-ref-in-cargo-lock.patch	New patch file that removes ring crate from Cargo.lock and comments out unused workspace members in Cargo.toml