feat(cast): keychain sign-authorization subcommand

[mablr]

Motivation

Add 'cast keychain sign-authorization' (alias 'sign-auth') for signing a Tempo KeyAuthorization with the connected browser/passkey wallet.

• Converts CLI flags (--limit, --scope/--scopes, --expiry, --chain-id, key type) into tempo-primitives types
• Drives BrowserSigner::sign_key_authorization via the local wallet bridge
• Prints the RLP-encoded SignedKeyAuthorization as 0x-prefixed hex (or JSON)

Enforce policy completeness at clap arg-parsing time:

• 'spending_policy' group: --limit | --deny-all-spending (mutually exclusive, required)
• 'call_policy' group: --scope | --scopes | --deny-all-calls (mutually exclusive, required)

Pending:

• feat(wallets): browser/passkey-backed keychain signing foundry-core#67
• feat: Tempo KeyAuthorization signing foundry-browser-wallet#67

Testing

Checkout foundry-rs/foundry-browser-wallet#67 and run pnpm run dev, and open browser http://localhost:5173.

Build and run cast:

cast keychain sign-authorization -h
cast keychain sign-authorization \
    <your_key> secp256k1 \
    --chain-id 4217 \
    --expiry 1810199310 \
    --limit 0x20c000000000000000000000b9537d11c60e8b50:100000000 \
    --scope 0x20c000000000000000000000b9537d11c60e8b50:transfer,approve \
    --browser --browser-development --browser-disable-open
...