cli: add --no-tc-string (dump+validate) and --failures-only (validate) output-shaping flags

[peczenyj]

Goal

Add two small CLI affordances for callers that pipe many TC strings through iabtcfv2:

• --no-tc-string (on both dump and validate): omit the input TC string from each output record. Callers locating records by line position (awk 'NR==3', sed -n '3p') don't need it echoed back.
• --failures-only (validate only): suppress records for TC strings that pass validation; emit only the failing ones.

Both flags reduce noise on large pipelines without changing exit-code semantics.

Existing flag landscape (verified)

bin/iabtcfv2 already has:

• --quiet|-q on both subcommands: suppresses STDOUT entirely, only the exit code is meaningful. This is a strict superset of the new flags — completely orthogonal, no naming conflict.
• --vendor-id|-v on dump: filters the JSON to a single vendor. Composes cleanly with --no-tc-string.
• --text|-t on validate: human-readable output instead of JSON Lines.
• --all|-a on validate: accumulate every failing rule (validate_all) instead of fail-fast.
• Negation precedent: --cmp-validator-verify-ssl! (Getopt::Long ! form).

The new flags follow the established naming style (hyphen-cased long names; no short option, since neither is high-frequency enough).

Proposed flags

--no-tc-string

Applies to: dump and validate.

Behavior:

• JSON output: omit the tc_string key from the emitted JSON object. All other fields unchanged.
• validate --text output: omit the leading TC string from each line. The reason text remains.
• No position field is added. Callers that need a locator use the input line number (awk 'NR==<n>', sed -n '<n>p'). Adding a counter would be feature creep and would change the JSON shape for users who don't ask for it.

--failures-only (validate only)

Behavior:

• For each input string, only emit a record if validation failed.
• Exit code semantics unchanged: still 0 if every string is valid (output may be empty), 1 on any failure, 2 on bad CLI usage.
• Composes with --all (failure record will accumulate every failing rule).
• Composes with --text (only failing lines printed).
• Composes with --no-tc-string (failing records emitted, each without the TC string).

Composition matrix

Combination	Behavior
--quiet (any)	Wins over both new flags. No STDOUT regardless. Exit code only.
--no-tc-string	All records emitted, none with tc_string.
--failures-only	Only failing records emitted, each with tc_string.
--no-tc-string --failures-only	Only failing records emitted, none with tc_string.
--text --no-tc-string	Text mode lines without leading TC string.
--text --failures-only	Text mode, only failing strings printed.
--all --failures-only	Each failing record carries its full reason set.
--vendor-id N --no-tc-string (dump)	Vendor-filtered JSON, no tc_string.

Tests

t/10-cli-iabtcfv2.t (the existing CLI test) grows subtests for:

• dump --no-tc-string against a known fixture: assert tc_string key is absent, all other expected fields present.
• validate --no-tc-string JSON path: same assertion.
• validate --no-tc-string --text text path: assert no TC string appears in any output line.
• validate --failures-only against a mixed batch (some valid, some invalid): assert only failing records emitted, exit code matches.
• validate --failures-only --no-tc-string: assert composition.
• validate --quiet --failures-only: assert STDOUT empty (quiet wins).

Documentation

• bin/iabtcfv2 POD updated to document both flags and the composition matrix above.
• The dump and validate help blocks (the subcommand_registry rows around lines 50-85) get the new flags appended in the same [short, long, args, description] shape.
• lib/GDPR/IAB/TCFv2.pm SYNOPSIS unchanged — these are CLI-only flags.

Out of scope

• Env var / config file integration for these flags — covered by Phase 9 (CLI Configuration Loading), which will pick up IABTCFV2_NO_TC_STRING / IABTCFV2_FAILURES_ONLY once it lands.
• Adding short options (-N, -F, etc.) — the existing one-letter slots are tight; these new flags aren't high-frequency enough to claim one. Callers can shell-alias if needed.
• Position counter / record numbering — see "No position field is added" above.

Definition of done

• Both flags wired into dump and validate (the validate-only --failures-only rejected by dump's GetOptions with the existing unknown-flag error path).
• POD documents both flags + the composition matrix.
• t/10-cli-iabtcfv2.t covers the eight subtests listed above.
• prove -lv t/10-cli-iabtcfv2.t passes on the v0.400 floor (Perl 5.8.9).
• Pass perlcritic, perltidy, and xt/spelling.t.

References

• Existing CLI: bin/iabtcfv2 — subcommand registry around lines 37-85, dump GetOptionsFromArray around line 144, validate around line 355.
• Existing CLI tests: t/10-cli-iabtcfv2.t.