fix(onnx): honour allowzero in Reshape and fix -1 inference (#3908)

A 0 in the target shape means copy the corresponding input dimension by
default, and a literal zero-length dimension when allowzero=1. The
attribute was never read, so the copy behaviour was always used.

Separately, the product that -1 is inferred against skipped zeros, but a
copied dimension is part of the volume, so -1 came out too large. ONNX's
own zero_and_negative_dim case reaches this without any attribute set.

Resolve every non -1 dimension first so the inference divides by the true
product, reject more than one -1, and reject -1 inference when the rest
of the volume is zero rather than dividing by zero.

Fixes #3907