Add --composite-rules flag to annotate multi license rules with required phrases

[Kaushik-Kumar-CEG]

references #5077

adds --composite-rules (-c) flag to the add-required-phrases CLI command.

For composite (AND/OR) rules, collects candidate phrases from existing required phrase rules with a single license key, skips generic licenses, then marks the rule only if every remaining key has a non-overlapping match in the text.

uses existing: find_phrase_spans_in_text for token-based matching, add_required_phrase_to_rule for safe injection with overlap and ignorable checks, and get_updatable_rules_by_expression for rule filtering.

Usage:

add-required-phrases --composite-rules --dry-run --verbose

Tests cover candidate collection, multi-key matching, the all-keys gate, existing markers, overlaps, rollback, dry-run behavior, and CLI wiring.

Tasks

• Reviewed contribution guidelines
• PR is descriptively titled and links the original issue above
• Focused tests pass
• Commits are in a uniquely named feature branch and have no merge conflicts

disclosure: used Claude to help review and clean up a few bugs in the script

[Kaushik-Kumar-CEG]

@AyanSinhaMahapatra ready for review when you have a moment

[Kaushik-Kumar-CEG]

@AyanSinhaMahapatra please review when you have a moment :)

[AyanSinhaMahapatra]

@Kaushik-Kumar-CEG thanks for the PR.

The logic is looking better than before and should work, but your tests aren't testing for the functionality added at all. And we need a lot of refactoring elsewhere. Also skip using attributes for this, as this is redundant double work.

Could you also rebase/merge from main?