OOB write in relu6
I was able to reproduce in both 2.14 and nightly as well.

<img width="995" alt="image" src="https://github.com/tensorflow/tensorflow/assets/118897289/3923ff7e-e267-46ba-91d2-c671cc682eac">

@pkgoogle Could you please look at this issue?

Thanks.
 I was able to reproduce on nightly as well:

```
./benchmark_model --graph=relu6.tflite
INFO: STARTING!
INFO: Log parameter values verbosely: [0]
INFO: Graph: [relu6.tflite]
INFO: Loaded model relu6.tflite
INFO: Created TensorFlow Lite XNNPACK delegate for CPU.
ERROR: failed to delegate RELU node #0
ERROR: Node number 2 (TfLiteXNNPackDelegate) failed to prepare.
ERROR: Restored original execution plan after delegate application failure.
INFO: The input model file size (MB): 0.00062
INFO: Initialized session in 1.422ms.
INFO: Running benchmark for at least 1 iterations and at least 0.5 seconds but terminate if exceeding 150 seconds.
Segmentation fault
```

@alankelly, can you please take a look? Thanks.
### Issue type

Bug

### Have you reproduced the bug with TensorFlow Nightly?

Yes

### Source

source

### TensorFlow version

tf 2.14.0

### Custom code

Yes

### OS platform and distribution

Ubuntu 18.04.6

### Mobile device

_No response_

### Python version

_No response_

### Bazel version

bazel 5.3.0

### GCC/compiler version

gcc 7.5.0

### CUDA/cuDNN version

_No response_

### GPU model and memory

_No response_

### Current behavior?

A maliciously constructed `Relu6` operator model may lead to an out-of-bounds write in the `Relu6Eval` function, resulting in denial of service due to accessing an illegal address.
```c
// activations.cc
TfLiteStatus Relu6Eval(TfLiteContext* context, TfLiteNode* node) {
  const TfLiteTensor* input;
  TF_LITE_ENSURE_OK(context, GetInputSafe(context, node, 0, &input));
  TfLiteTensor* output;
  TF_LITE_ENSURE_OK(context, GetOutputSafe(context, node, 0, &output));
  ReluOpData* data = reinterpret_cast<ReluOpData*>(node->user_data);
  switch (input->type) {
    case kTfLiteFloat32: {
      size_t elements = input->bytes / sizeof(float);
      const float* in = GetTensorData<float>(input);
      const float* in_end = in + elements;
      float* out = GetTensorData<float>(output);
      for (; in < in_end; in++, out++) *out = std::min(std::max(0.f, *in), 6.f);  // this line 
```
[relu6.zip](https://github.com/tensorflow/tensorflow/files/13037007/relu6.zip)


### Standalone code to reproduce the issue

```shell
I use the benchmark tool built according to [this official guide](https://www.tensorflow.org/lite/guide/build_cmake#step_1_install_cmake_tool), as follows:
1. git clone https://github.com/tensorflow/tensorflow.git tensorflow_src
2. mkdir tflite_build
cd tflite_build
3. cmake ../tensorflow_src/tensorflow/lite
4. cmake --build . -j
5. cmake --build . -j -t benchmark_model

The benchmark is in the tools directory


When I use the benchmark tool for PoC validation, it causes the TensorFlow Lite inference process to be subjected to a DOS（coredump).

❯ ./benchmark_model --graph=../poc/relu6.tflite
INFO: STARTING!
INFO: Log parameter values verbosely: [0]
INFO: Graph: [../poc/relu6.tflite]
INFO: Loaded model ../poc/relu6.tflite
INFO: Created TensorFlow Lite XNNPACK delegate for CPU.
ERROR: failed to delegate RELU node #0
ERROR: Node number 2 (TfLiteXNNPackDelegate) failed to prepare.
ERROR: Restored original execution plan after delegate application failure.
INFO: The input model file size (MB): 0.00062
INFO: Initialized session in 181.67ms.
INFO: Running benchmark for at least 1 iterations and at least 0.5 seconds but terminate if exceeding 150 seconds.
[1]    12443 segmentation fault (core dumped)  ./benchmark_model --graph=../poc/relu6.tflite
```


### Relevant log output

_No response_