(This is a rebased and expanded version of #6015 now that the self-assembling switch zone has landed.)

I need to make some changes to zone-setup to support Reconfigurator rebalancing boundary NTP zones, and found it a little trickier to work with than expected. I think there were two reasons for this:

• The use of clap's builder interface instead of derive (addressed in 3708774), which requires a surprising amount of boilerplate and custom parsing functions, most of which are now gone
• Using Result<(), CmdError::Failure> throughout, when really only main cares about that and everywhere else could use anyhow::Result<()> (mostly addressed in cac26dd); I also tried to make sure we always attach some .context() to errors (the old code did this in some cases but not all)

I also made a cleanup pass through the new switch zone user setup code; the biggest win there was reusing illumos_utils::execute() to check for success and build detailed error messages on failure. There are some other minor changes like long flags with different names (AFAICT we only ever use the short flags in SMF manifests, so this shouldn't require other changes) and potential bugfixes (e.g., the switch zone setup code was only correct for 0 or 1 profile, and should now be correct for 2+ if we ever need more than one).

While all these should be correct, I want to run this through madrid before merging. I think it's ready for review, though; will update here once I do the madrid test.