Rethinking Visual Privacy: A Compositional Privacy Risk Framework for Severity Assessment with VLMs