feat: add warning for mixed operators without parentheses

[ivanauth]

When writing permission expressions like viewer - blocked & editor, it's easy to assume arithmetic-style precedence. But SpiceDB's actual precedence (exclusion binds loosest, then intersection, then union) can lead to unexpected behavior.

This adds a lint warning that flags mixed operators at the same scope, nudging users to add parentheses and make their intent explicit.

Example:

permission view = viewer - blocked & editor  // warns
permission view = (viewer - blocked) & editor  // ok
permission view = viewer + editor + blocked  // ok (same operator)

The warning can be suppressed with:

// spicedb-ignore-warning: mixed-operators-without-parentheses
permission view = viewer - blocked & editor

Fixes authzed/zed#598

[codecov]

Codecov Report

❌ Patch coverage is 58.22785% with 66 lines in your changes missing coverage. Please review.
✅ Project coverage is 73.75%. Comparing base (54211de) to head (1742057).

Files with missing lines	Patch %	Lines
pkg/namespace/metadata.go	28.08%	36 Missing and 5 partials ⚠️
pkg/development/warningdefs.go	29.42%	11 Missing and 1 partial ⚠️
pkg/schemadsl/compiler/translator.go	81.97%	7 Missing and 4 partials ⚠️
pkg/namespace/builder.go	75.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2786      +/-   ##
==========================================
- Coverage   73.80%   73.75%   -0.04%     
==========================================
  Files         493      493              
  Lines       59295    59447     +152     
==========================================
+ Hits        43755    43841      +86     
- Misses      12384    12438      +54     
- Partials     3156     3168      +12     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[josephschorr]

@ivanauth this won't actually work in all cases, because expressions can cross multiple lines. Instead, this should likely be done by marking the expression during compilation with a piece of metadata, and having the warnings generator read that metadata

[ivanauth]

Switched from source-scanning to compile-time metadata detection per review feedback. Added NodeTypeParenthesizedExpression wrapper in parser to track explicit grouping, then detect mixed operators during AST translation. Also fixed edge case where top-level parentheses like (a + b - c) would skip the warning.