feat(meta): add struct_vuln_rule option for combining structural risk flags

[shamykyzer]

closes #464

• struct_vuln in the meta attack vulnerability matrix was hard coded to flag a record when any structural indicator fired (k below threshold, class disclosure, or smallgroup risk)
• this adds a struct_vuln_rule option to MetaAttack accepting "or" (default, behaviour unchanged) or "and" so the flag can require all indicators instead, as the issue asks
• i moved the combination itself into structural_attack.combine_risk_flags() since as i read the issue that felt like where it belongs, next to the code that produces the indicators, happy to move it back into meta_attack.py if you'd rather
• the chosen rule shows up in attack_params and global_metrics in report.json so downstream readers can tell which rule produced the flags
• the rule is validated at construction time like behaviour, so a typo fails before any sub attack runs rather than mid workflow

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.67%. Comparing base (b7885f1) to head (31e5ea9).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #473   +/-   ##
=======================================
  Coverage   99.66%   99.67%           
=======================================
  Files          28       28           
  Lines        3633     3651   +18     
=======================================
+ Hits         3621     3639   +18     
  Misses         12       12           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.