Enforce that options (.e.g. --watch) must come last in our CLI.

Currently you can do stuff like hsm --watch push. This is ambiguous because it makes it look like you're trying to do hsm --watch=push. Although we don't accept option values not joined to the option name via =, other command applications do. Our users may mistake hsm for a command that does. We would then misinterpret that argument that was intended for an option as either a command or a command argument which could cause unexpected behaviour.

• Deprecate it starting 0.22
• Enforce it starting 0.23