support applying separately constructred diff (similar to terraform plan/apply)

Similar to `terrafrom plan/apply` it would be super useful if the diff and apply stages could be split into two invocations of the tool. This would allow better integration with systems where user input can't be provided via a TTY (e.g. Buildkite pipelines). Currently the only solution in these cases is to use `-y`, but at least initially this isn't what I'd like to do when deploying production services.