sop update-key: add --replaced-keys and --replaced-keys-out

Closes: #99

I tried several different variations, and this one appears to be the one that makes the most sense. If implementers or application developers tell me to go back to the drawing board, i can also offer some of my other designs.

I note that there is some lack of flexibility here: in particular, it's a bit clunky to try to do a many-to-one replacement group. (you can do it by dearmoring a bunch of KEYS to concatenate them, but then you can't easily split them back apart again later)

I ran into this issue because i really want the user to be able to keep their secret keys (even in a fallback pool) separate if they want to do so. The other approach would be to emit the cluster of (fallbacks+replacement) TSKs as a single KEYS object, but then that makes it hard to split them up and deal with them independently.

I think this approach is OK, as we should focus on a simple one-step migration and making sure that makes sense and is easy to do.