The revocation subcommands are now subcommands of irma issuer.

fix: use forks of cobra, viper, pflag so that depending packages don't require 'replace' directives in their go.mod

The URL to the server to which issuance records and revocation commands are sent now no longer needs to be put in the scheme, and may thus be kept private to the issuer. Instead multiple URLs are now in the scheme, which are only required to host revocation records for irmaclients and requestors to update their revocation state.