Add TSAN+UBSAN and ASAN+UBSAN sanitizer CI jobs and migrate CI asset downloads to OneDrive

[Akilan-Sivakumar]

Summary

• Added TSAN+UBSAN and ASAN+UBSAN build/test jobs to catch threading and memory-safety issues before merge.
• Migrated prep-assets from downloading CI assets off GitHub release assets to downloading them from OneDrive (via Azure OIDC + Graph API).

Changes

New sanitizer jobs

• build-tsan / build-asan: build x265 with sanitizer flags across gcc/clang × 8bit/10bit, and verify the binary is actually instrumented.
• test-tsan / test-asan: run each binary against a set of test clips and fail if any sanitizer issue is detected.
• All PR-only (if: github.event_name == 'pull_request_target'), same as the existing smoke test jobs.
• final-status now includes these in its merge-gate checks.

Asset source change

• prep-assets now logs in via Azure OIDC and pulls smoke-test assets and the new sanitizer video bundle from OneDrive instead of GitHub release assets.
• Added id-token: write permission (needed for OIDC) and bumped the job timeout to 30 min for the extra download.

Security note

• The id-token: write permission and Azure credentials (AZURE_CLIENT_ID / AZURE_TENANT_ID) are scoped to the prep-assets job only - no other job has access to them.
• prep-assets does not check out any PR code, so there's no path for a malicious PR to influence this job or exfiltrate the OIDC token via untrusted code execution.