lex: add more identity helpers

[bnewbold]

The current push/use-case for this is an identity cache microservice.

---

These are ideas/follow-ups from discussions with @dholms during account migration design.

One example use-case refreshIdentity is did:web users, or folks that manage their did:plc out-of-band. In these cases, users need a way to tell their PDS that their identity has updated and should be re-resolved server-side. Another is somebody who fixes their handle, but still appears invalid from AppView; that might not result in an #identity event on firehose, and they might want to poke the AppView to refresh to fix it. In an expansive sense, this could be implemented by every atproto service (Relay, AppView, Mod Service, etc), with a rate-limit. We probably wouldn't want to start with that though; I left it ambiguous with "might require auth, and could be ignored".

The second is a mechanism to resolve a DID doc and handle together. This is intended for clients which don't want to bother talking to PLC, and just want to ask their PDS to resolve an identity for them. This could become more important/useful in the future if we add more DID methods. Really it just feels like a missing piece for now, in that we have resolveHandle but not resolveDid (this rolls up the functionality of the later).

[DavidBuchanan314]

I was thinking about the OOB did-management use case too - it would be nice if an authenticated refreshIdentity() against a PDS would trigger it to emit #handle and/or #identity events in the firehose, if relevant (edit: oops, you basically already said that!)