This fixes a regression from #2454. In that PR, we added an error when
positional arguments are detected. I believe that's correct, but we
were silently relying on the previous behavior in the CLI commands.

This commit changes the CLI commands to use a new argsIterator function
that creates an iterator that skips the first argument (argv0). This is
the same behavior that the config parsing does and now uses this shared
logic.

This also makes it so the argsIterator ignores actions (`+things`)
and we document that we expect those to be handled earlier.

Rather than storing a list of errors we now store a list of
"diagnostics." Each diagnostic has a richer set of structured
information, including a message, a key, the location where it occurred.

This lets us show more detailed messages, more human friendly messages, and
also let's us filter by key or location. We don't take advantage of
all of this capability in this initial commit, but we do use every field
for something.