feat: add HierarchyChangeAuth command

[novag]

see definition in Part 3, Commands, section 24.8

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[chrisfenner]

Thanks for the change! I had a couple of minor comments, otherwise looks ready to go.

[novag]

Thanks! In which cases would you want the t.Fatal to be a t.Error?

[chrisfenner]

To be more precise, I think lines 31, 45, and 62 in change_auth_test.go could all be t.Errorf. There aren't currently more test assertions after these lines so it's not a big deal. Either Fatalf or Errorf will fail the test, but Errorf is preferred unless the failure means the test should abort (https://google.github.io/styleguide/go/decisions#keep-going).

[chrisfenner]

Thank you @novag for the change and for the updates in response to my minor feedback items!