Auto-resolve additive composer.json changes by re-resolving affected packages

## Background

Today `resolve-composer-lock-conflict` handles only the content-hash-only conflict: if both branches changed `composer.json`, the action bails and a human re-resolves the lock locally. PR #14 adds a `composer install --dry-run` gate so bad auto-resolves never get pushed — which means we can safely *try* more ambitious resolutions and fall back to the human path if the gate fails.

## Proposal

Extend the action to handle a narrow but common case: **additive `composer.json` changes** — i.e. both sides added new `require` / `require-dev` entries and neither changed an existing constraint.

Algorithm:
1. After the merge, diff the resolved `composer.json` against the merge base.
2. If the only changes are **new keys** in `require` / `require-dev` (no existing constraint bumped, no key removed), collect the list of added packages.
3. Run `composer update --with-all-dependencies --no-scripts --no-interaction`.
4. Run the existing `composer install --dry-run` gate.
5. On success, commit and push as today. On failure, bail to human resolution.

Anything that bumps or removes an existing constraint stays manual — those are the cases where the resolver can pull in surprising transitive changes that a reviewer should see.

## Why additive-only

- **Deterministic.** New requires don't reshape the existing dependency graph; the resolver's choices are narrow.
- **Small blast radius.** Transitive churn is limited to what the new packages bring in.
- **Reviewer-friendly.** The bot commit corresponds to packages explicitly added by humans in the PR, so the lock changes match reviewer expectations.
- **Covers a real chunk of remaining conflicts** — independent feature branches each adding their own dependency is the next-most-common shape after content-hash-only.

## Opt-in

Suggest gating this behind a new input (default `false`) so existing callers keep current behaviour:

```yaml
with:
auto_resolve_additive: true
```

## Out of scope

- Constraint bumps on existing packages — stays manual.
- Removed packages — stays manual.
- Anything requiring judgement about which side's intent to honour.