[nathanjcochran]

Adds tiger branch, behind TIGER_EXPERIMENTAL, for managing branches of fluid services. It has create, list, get, delete, start/resume, stop/pause, resize, rename, and update-password. tiger service branch is the same command as tiger branch create.

It's built on the API's service-nested branch endpoints and its new resolve endpoint. Neither is deployed yet, so this has only been tested against mocks.

• Refs. The commands take a branch by ID or name, resolved through the resolve endpoint restricted to branches. That one call also gives the parent service ID the nested endpoints need. There's no default branch: service_id only ever holds a service ID. create and list take a service, falling back to the default service.
• Flags and output follow the matching tiger service commands. CPU/memory are checked against the fluid combinations, --iops works as on the service commands, and the output shows the parent service's name with its ID.
• Passwords. create saves the branch's initial password the way service create does. update-password sets it through the branch endpoint, using the same helpers as the service command.
• Read-only mode. A branch has no environment tag and always counts as DEV. So read_only=prod allows branch operations, even on branches of a PROD service, and all blocks them.
• Completion offers branch names, falling back to IDs, from the API's project-wide branch list.
• Waiting shares the service wait loop (WaitForBranch).

create ends with "Connect with: tiger db psql ". The db commands accept branches from the next PR in the stack.

Follow-ups:

• branch logs. The API has no branch logs endpoint yet.
• Storage breakdown. The API doesn't return one for branches.
• Console URL. There's no Console URL for branches until the Console supports them (TODO in prepareBranchForOutput).