fix(graph): key IMPORTS edge dedup on local_name, not just source/target

[apappas1129]

What does this PR do?

Closes #768: a single import { A, B } from './lib' statement produced exactly
one IMPORTS edge instead of two — whichever symbol got written second
silently overwrote the first.

cbm_gbuf_insert_edge() (src/graph_buffer/graph_buffer.c) dedups edges on
(source_id, target_id, type) only. Two named imports from the same specifier
resolve to the same (source_file, target_file) pair, so the second
IMPORTS edge collides with the first on that key. On collision the function
doesn't merge or reject — it replaces properties_json outright (the
existing /* Merge properties (just replace for now) */ comment suggests
this was a known stub).

This has a bigger blast radius than "who imports X" queries: pass_calls.c,
pass_usages.c, pass_semantic.c, and pass_lsp_cross.c all build their
local_name -> resolved module QN maps for cross-file call resolution by
parsing exactly one local_name out of each IMPORTS edge's properties. So
the dropped symbol's calls also failed to resolve cross-file, not just the
import edge itself.

make_edge_key() now folds local_name into the dedup key specifically for
IMPORTS edges, so two different symbols imported from the same specifier
become two distinct edges. A re-inserted identical import (e.g. an idempotent
re-index) still dedups to one edge. No changes were needed in any of the four
downstream consumers — they already iterate edges and parse one local_name
per edge; they simply see both edges now that dedup stops collapsing them.
Other edge types (CALLS, HTTP_CALLS, DEFINES, ...) keep their original
(source, target, type) key, unchanged.

Checklist

• Every commit is signed off (git commit -s)
• Tests pass locally (make -f Makefile.cbm test) — full suite green
  except one pre-existing, unrelated RSS-ceiling test in
  test_incremental.c (~2.6GB vs 2048MB limit) on this machine
• Lint passes (make -f Makefile.cbm lint-ci) — could not verify
  locally, cppcheck/clang-format are not installed in this
  environment; relying on CI
• New behavior is covered by a test: added gbuf_imports_multi_symbol_dedup
  in tests/test_graph_buffer.c, asserting two same-target imports with
  different local_name produce distinct edges while a repeated
  identical import still dedups to one