Companies operating in conflict-affected areas: legal frameworks, risks and obligations