CMake Options CI broken by vendored spvdb: SLANG_LIB_TYPE=STATIC and SLANG_ENABLE_ASAN builds fail to link

The weekly scheduled **CMake Options** workflow has been failing since the Sep 12 run: [run 34682178730](https://github.com/shader-slang/slang/actions/runs/34682178730) (master @ `4d7939e59`). 18 build jobs fail, plus the `check-cmake` aggregation gate.

The previous run on Sep 5 (`961e4e59e`) was green. All 18 failures fall into exactly two option configurations, and both were introduced by #12896 ("Vendor spvdb and add SPVDB_DEBUGGER regression tests under `tests/debuginfo`", `f94dd4ecc`, merged Sep 9), which links the vendored `spvdb` static library into `slang-test`.

## Failure 1 — `SLANG_LIB_TYPE=STATIC` (10 jobs, all platforms)

`slang-test` fails to link ([linux-debug job](https://github.com/shader-slang/slang/actions/runs/34682178730/job/103522728492)):

```
libspvdb.a(image_sampler.cpp.o): in function `spvdb::load_image(...)':
tests/spvdb/lib/interpreter/image_sampler.cpp:34: undefined reference to `stbi_loadf'
tests/spvdb/lib/interpreter/image_sampler.cpp:41: undefined reference to `stbi_image_free'
```

Three pre-existing decisions collide here:

- `cmake/CompilerFlags.cmake` defines `STB_IMAGE_STATIC` when `SLANG_LIB_TYPE` is `STATIC` (from #6374). That gives every `stbi_*` function internal linkage.
- `tools/slang-test/slang-test-main.cpp` is the single translation unit that compiles `STB_IMAGE_IMPLEMENTATION`.
- `tests/spvdb/CMakeLists.txt` sets `SPVDB_SKIP_STB_IMAGE_IMPL=1` whenever spvdb is built as a subdirectory, on the assumption that the parent provides the symbols.

In a shared build that works. In a static build the parent's `stbi_*` symbols never leave `slang-test-main.cpp`'s translation unit, so spvdb has nothing to link against.

## Failure 2 — `SLANG_ENABLE_ASAN=ON` (8 jobs, Windows only)

```
spvdb.lib(spvdb.obj) : error LNK2038: mismatch detected for 'annotate_string':
  value '0' doesn't match value '1' in cmake_pch.obj [slang-test.vcxproj]
... 12 mismatches; fatal error LNK1319
```

`spvdb` is created with a plain `add_library(spvdb STATIC ...)` rather than through `slang_add_target`, so it never goes through `set_default_compile_options` and never receives `/fsanitize=address`. `slang-test` does. MSVC's ASan changes the ABI of the annotated standard containers (`annotate_string` / `annotate_vector`), so sanitized and unsanitized objects cannot be linked into the same binary.

`check-cmake` is only the aggregation gate ("One or more CMake option builds failed or were cancelled") and has no independent failure.

## Proposed fix

1. **STATIC**: gate `SPVDB_SKIP_STB_IMAGE_IMPL` on whether the parent's `stbi_*` symbols are actually linkable, rather than merely on spvdb being a subdirectory. Slang turns the skip off when `SLANG_LIB_TYPE=STATIC` so spvdb compiles its own copy — safe, since the parent's copies have internal linkage and cannot collide.
2. **ASAN**: extract the sanitizer block of `set_default_compile_options` into a reusable `add_sanitizer_options(target)` and apply it to `spvdb`, so the vendored library keeps its own warning configuration but agrees with `slang-test` about ASan.

Both were verified locally by configuring and building `slang-test` from scratch (VS 2026 / Ninja Multi-Config, Debug): `SLANG_LIB_TYPE=STATIC` and `SLANG_ENABLE_ASAN=ON` both link, and the default shared/non-ASan configuration is unchanged.

[]