Implement `arc audit`, which triggers audits. Rough plan is:
- Do a future-proofing check:
- have the workflow check for `diffusion.createcommit` using `conduit.query`;
- or just give up and accept the `X.createcommit` APIs indefinitely.
- Look up users with `user.query` to get their PHIDs.
- Look up commit PHIDs with `diffusion.querycommits` or similar. This needs to be implemented, and will deprecate `diffusion.getcommit`.
- Call `diffusion.createcomment` to create the audit.
- Needs a tweak to accept auditor PHIDs.