Flexible app flag

If the run command has a `-a` in it, require users to provide the command
after a `--`.

For all other commands, allow the `-a` flag to appear anywhere.

This might be confusing because the app flag is the only one to get special treatment like this (other flags must be provided in the correct place). However, @fdr thinks this will be sufficient to make his life better.

Here are some examples of things that are accepted:

```bash
➜ hk unset -a myapp IMPORTANT
➜ hk unset IMPORTANT -a myapp

➜ hk run bash
➜ hk run -a myapp bash
➜ hk run -- ls -a bin
```

But an ambiguous `-a` flag is rejected:

```bash
➜  ~  hk run bash -a myapp
error: ambiguous -a flag provided
error: If you really wanted to run "bash -a myapp", please re-run with a -- before the command.
```

As is a duplicate `-a` flag:

```bash
➜  hk unset IMPORTANT -a hkdist -a wtf            
error: duplicate -a flag provided
```