Improve testability and test coverage of cli tools

[simon]

Currently nimbus uses the java Singleton anti-pattern. That makes it really hard to make repeatable end-to-end tests. It also makes it hard to test thinbus against nimbus. It also makes it hard to test any new version of nimbus against an older version by injection of test vectors generated by the older version. The codebase also doesn't make it easy to subclass and override in test doubles to only exercise specific parts of the auth flow.