[op-deployer] generate gnosis safe wrapped calldata

# Overview

`op-deployer upgrade` creates calldata for the opcm.upgrade tx, but there is an additional step needed before that calldata can be sent.

Gnosis safe users (most of our users) need to wrap that calldata within a gnosis safe tx, e.g:
```
cast calldata "execTransaction(address,uint256,bytes,uint8,uint256,uint256,uint256,address,address,bytes)" "" "0" "" "1" "0" "0" "0" "0x0000000000000000000000000000000000000000" "0x0000000000000000000000000000000000000000" ""
```

# Questions
1. How do we produce the arg if the safe has a signature threshold of 1?
2. How do we produce the arg if the safe has a signature threshold > 1?
3. Should we try to actually produce the gnosis safe calldata, or just provide clear instructions for the user based on if they fall in [1] or [2] above?
4. How should we support users who don't use gnosis safe (e.g. mcp)? Should we provide instructions for their flow or just make it clear they shouldn't use the gnosis safe instructions?
5. Should we help provide a tenderly simulation link?