[Relax][Frontend][ONNX] Support dynamic Range bounds

[napronald]

Fixes #20064.

This updates ONNX Range lowering to support runtime scalar bounds, following the same strategy used by Relax TFLite dynamic RANGE lowering. The strategy is to compute the output length in graph, lift it to a symbolic dimension, and rebuild the range as arange(0, length) * delta + start.

The existing constant path is preserved, and symbolic PrimExpr bounds continue to use relax.op.arange directly. Tests are added for constant Range, parametrized dynamic scalar Range inputs, and symbolic PrimExpr limit.

[tlopex]

Overall the approach looks good, but I think there are a few cases we should fix before merging. The main one is that the dynamic float32 path computes the range length in float32, so something like Range(0, 0.3, 0.1) produces 3 elements while ONNX Runtime produces 4. Also, mixed runtime tensor and PrimExpr bounds can fail because scalar_expr passes the PrimExpr to relax.op.astype, and the PrimExpr-only path still relies on relax.arange, whose shape inference is incorrect for negative steps or empty ranges. Could we handle PrimExpr explicitly, use higher precision for the float count, and add tests for these cases?

[napronald]

I have updated the lowering to handle these cases before the arange call. The float count is now computed in float64, while the final values still use the ONNX output dtype. I also removed the direct PrimExpr-only path and handle PrimExpr bounds explicitly through the shape/tensor bridge.

Tests are added for Range(0, 0.3, 0.1), mixed tensor/PrimExpr bounds, and negative-step/empty PrimExpr ranges.