Expose the parsed expression tree from Program (for explain/trace tooling, linting and sub-expression evaluation)

## Motivation

`Program.references()` answers "which names does this expression use", but several things people ask for need the structure of the expression, not just its leaves:

- #30 wants to know *which* element or clause made an `exists`/`&&` chain true or false. cel-rust has no evaluation hooks, so a wrapper-side `explain()` would have to walk the tree and re-evaluate sub-expressions.
- Policy linting beyond name lists: "no `matches()` on untrusted input", "no more than N nested comprehensions", "field access only under `request.`".
- Pretty-printing / normalising expressions stored by users.

## What upstream gives us

`cel::Program::expression()` returns the parsed `Expression` (`IdedExpr`: an id plus an `Expr` enum covering literals, identifiers, selects, calls, lists, maps, structs and the expanded comprehensions). No protobuf AST, but the shape is close to `cel.expr.Expr` and would be straightforward to mirror as nested dicts or small dataclasses.

## Proposal

`Program.ast()` returning a plain, JSON-serialisable tree, e.g. `{"kind": "call", "function": "_&&_", "args": [...]}`, with comprehension macros shown in their expanded form (that is what cel-rust holds after parsing; the original macro call is not retained). Ship it as provisional, tied to the cel-rust version, and note that the node shapes may change when cel-rust changes its AST.

A Python-side `cel.explain(program, context)` built on it could then evaluate each boolean sub-expression and report the first failing clause, which covers the `exists`/`all` case in #30 without upstream changes, at the cost of re-evaluation (custom functions run again).

Start by inspecting the Python Program wrapper and cel::Program::expression(), then compare its IdedExpr and Expr variants with the proposed JSON-serialisable tree. Done means Program.ast() exposes literals, identifiers, selects, calls, lists, maps, structs and expanded comprehensions, with provisional documentation tied to the cel-rust version.

由索引模型根据 Issue 内容生成。