identity package improvements

[bnewbold]

• method/mechanism to "just" resolve DID document, but still use caching etc. example use-cases are the Relay, and service auth validation
• ergonomic way to handle invalid auth, resulting in cache purge and retry. eg, for service auth validation when upstream signing key changes
• more/better error types
• possibly a mechanism to continue using cached values for longer than the cache window (eg, another few hours or day) if can't connect at all to DID PLC directory (or other network/connection errors, as distinct from explicit "identity is gone" errors)