Add --composite-rules flag to annotate multi license rules with required phrases

[Kaushik-Kumar-CEG]

references #5077

Adds --composite-rules (-c) flag to the add-required-phrases CLI command.

For composite (AND/OR) rules, parses the expression into individual license keys, builds a per-key mapping of candidate phrases from license attributes (name, short_name, spdx_license_key) and is_required_phrase rules, then marks the rule only if ALL keys have at least one matching phrase in the text.

Uses existing infrastructure: find_phrase_spans_in_text for token-based matching, add_required_phrase_to_rule for safe injection with overlap/ignorable checks, get_updatable_rules_by_expression for rule filtering.

Usage:

add-required-phrases --composite-rules --dry-run --verbose

Results: 1071 composite rules annotated in dry-run.

Tasks

• Reviewed contribution guidelines
• PR is descriptively titled and links the original issue above
• Tests pass
• Commits are in uniquely-named feature branch and has no merge conflicts

[Kaushik-Kumar-CEG]

@AyanSinhaMahapatra ready for review when you have a moment

[Kaushik-Kumar-CEG]

@AyanSinhaMahapatra please review when you have a moment :)