Migration tool

[Directly manipulating the checkpoint DB](https://groups.google.com/a/chromium.org/g/ct-policy/c/Zw80ZBFdQgQ) is scary, but migrating logs is a legitimate use case. What if operators could do something like this instead:

Export the checkpoint for LOG_ID to file, and mark the log as frozen in checkpoint.db to prevent further updates on this instance:

```
$ sunlight-checkpoint export checkpoint.db LOG_ID file
```

Import the checkpoint from file to checkpoint.db, failing if checkpoint.db already contains a different checkpoint for the log:

```
$ sunlight-checkpoint import file checkpoint.db
```

Start with the sunlight-checkpoint entry point and checkpoint.db handling; the issue gives the proposed export and import command forms. Done means export writes the specified LOG_ID to a file and freezes it in checkpoint.db, while import rejects a different existing checkpoint for that log.

Written by the indexing model from the issue text.