Signed-off-by: oppiliappan <me@oppi.li>

update to urfav/cli/v3

This is needed as part of the "adversarial PDS migration" flow, because
the existing `goat account service-auth` command requires the origin PDS
to create the token.

```
NAME:
goat account service-auth-offline - create service auth token via locally-held signing key

USAGE:
goat account service-auth-offline [command options] [arguments...]

OPTIONS:
--atproto-signing-key value private key used to sign the token (multibase syntax) [$ATPROTO_SIGNING_KEY]
--iss value the DID of the account issuing the token
--endpoint value, --lxm value restrict token to API endpoint (NSID, optional)
--audience value, --aud value DID of service that will receive and validate token
--duration-sec value validity time window of token (seconds) (default: 0)
--help, -h show help
```

Adds the following new subcommands to `goat plc`, for PLC identity
management without the involvement of a PDS:

```
genesis produce an unsigned genesis operation
calc-did calculate the DID corresponding to a signed PLC operation
sign sign an operation, ready to be submitted
submit submit a signed operation to the PLC directory
update apply updates to a previous operation produce a new one (but don't sign or submit it, yet)
```

I think it's unnecessary to specify JSON format everywhere

Will probably self-merge.

- host lists and status info
- more flexible firehose-mode host parsing (wss:// vs https://)
- include blocks in `#sync` firehose output (if requested)

This only touches code I am developing, so will probably self-merge