gltfio: heap OOB read + std::vector OOB on malformed KHR_materials_variants mapping (createMaterialVariants)

[adilburaksen]

A malformed KHR_materials_variants mapping in an untrusted glTF causes a heap out-of-bounds access. FAssetLoader::createMaterialVariants uses the per-primitive mapping's variant value to index the variant array without clamping to variants_count.

Affected code — libs/gltfio/src/AssetLoader.cpp (createMaterialVariants, ~L958–969):

const size_t variantIndex = srcPrim.mappings[i].variant;  // attacker-controlled, unclamped
... mVariants[variantIndex] ...                            // OOB read if variantIndex >= variants_count
... .mappings.push_back(...)                               // OOB std::vector read/write

Repro: top-level KHR_materials_variants with variants:[{}] (count = 1) + a primitive mapping with "variant":1000. With an ASan gltfio build: AddressSanitizer: heap-buffer-overflow READ of size 8 ... 40 bytes after 56-byte region (std::vector::push_back).

Impact: OOB read of the variant array plus an OOB std::vector operation on push_back (potential OOB write). Distinct from the JOINTS_0 issue (different file, different input, OOB write vs read).

Suggested fix: guard variantIndex against mVariants.size() before indexing (skip the malformed mapping, matching the existing "index out of range → continue" handling for TEXCOORD/JOINTS set indices). I previously opened PR #10174 with this fix; it was auto-closed (maintainer-only directory), so filing here as requested.