More explicit semantics for `seabeectl update`

[awandke]

current seabeectl udpate will update a policy if it exists, or add a policy if it does not exist.

The semantics would be clearer if

• seabeectl add adds a new policy and errors if policy already exists
• seabeectl update updates an existing policy and errors if policy does not exist
• seabeectl apply adds or updates depending on whether or not the policy already exists