verify serialized buffer before accessing it in the deserializer

[Nashit-h]

deserialize() and deserialize_parameters() in src/Deserialization.cpp call Serialize::GetPipeline(data.data()) and then chase table, vector, and string offsets straight out of the buffer with no structural check, so a malformed .hlpipe reads out of bounds (ASAN reports a heap-buffer-overflow read while walking output_names on a buffer with a corrupted root offset). Run a flatbuffers::Verifier over the data first and reject anything that fails before any accessor runs. Finish() writes no file identifier, so this verifies with VerifyBuffer() rather than the generated VerifyPipelineBuffer, which checks for the 'HLDE' identifier and would reject every valid file; valid pipelines verify and deserialize unchanged.

[codecov]

Codecov Report

❌ Patch coverage is 16.66667% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 69.99%. Comparing base (54cd1d8) to head (74dfcbd).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
src/Deserialization.cpp	16.66%	4 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9395      +/-   ##
==========================================
+ Coverage   69.89%   69.99%   +0.09%     
==========================================
  Files         261      261              
  Lines       79362    79368       +6     
  Branches    19349    19351       +2     
==========================================
+ Hits        55474    55554      +80     
- Misses      17926    17944      +18     
+ Partials     5962     5870      -92     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.