Variables inside a graph are mutable if you fetch them

Start with the mutableVariablesTest example in the issue and reproduce it on the CPU and GPU backends described there. Trace how fetched Variable tensors are handled, then verify that fetching does not unexpectedly mutate graph state and that the behavior is consistent across backends.

System information

• Have I written custom code (as opposed to using a stock example script provided in TensorFlow): Yes
• OS Platform and Distribution (e.g., Linux Ubuntu 16.04): macOS, Oracle Linux 7.
• TensorFlow installed from (source or binary): binary
• TensorFlow version (use command below): v0.3.1

Describe the current behavior

This test fails as initial = 3.0f and after = 9.0f.

  public void mutableVariablesTest() {
    try (Graph g = new Graph();
         Session s = new Session(g);
         TFloat32 inputTensor = TFloat32.vectorOf(1.0f,1.0f,1.0f)) {
      Ops tf = Ops.create(g);

      Placeholder<TFloat32> input =
              tf.withName("input").placeholder(TFloat32.class, Placeholder.shape(Shape.of(3)));
      Variable<TFloat32> a = tf.variable(tf.constant(new float[]{1.0f,1.0f,1.0f}));

      ReduceSum<TFloat32> output = tf.withName("output").reduceSum(tf.math.mul(a,input),tf.constant(0));

      Init init = tf.init();

      s.run(init);

      Tensor t = s.runner().feed(input,inputTensor).fetch(output).run().get(0);
      float initial = ((TFloat32)t).getFloat();
      t.close();

      TFloat32 aTensor = (TFloat32) s.runner().fetch(a).run().get(0);
      aTensor.setFloat(3.0f,0);
      aTensor.setFloat(3.0f,1);
      aTensor.setFloat(3.0f,2);
      aTensor.close();

      t = s.runner().feed(input,inputTensor).fetch(output).run().get(0);
      float after = ((TFloat32)t).getFloat();
      t.close();

      assertEquals(initial,after);
    }
  }

It fails when running on CPU on macOS and Linux. I checked on Linux on a GPU and the test passes.

Describe the expected behavior

The test should pass consistently across all backends, as I would expect to get a copy of the weights back rather than something that lets me directly mutate the state of the graph in all cases rather than just on GPU. At the very least it should fail consistently on both CPU and GPU, but I think we should disallow direct mutation of variables outside of a graph.