Add --plstage argument

[davdiv]

Summary

Without --plstage, the --preloader argument is parsed but never sent to the
device for any DA/flash subcommand (printgpt, r, w, e, rf, wf,
gpt, rs, rl, wl, es, footer, da, …) — only peek and plstage
honor it today. This means a user holding a preloader file on disk has no way
to make printgpt and the other DA/flash commands boot the device into it
before reading/writing.

With this change, I am now able to use mtk to read partitions from my
bricked BraX3 device by sending my own patched preloader first, then
reading the GPT and any partition on top of it. Before this, I could not run
printgpt at all on that device, because the stock preloader was failing and
nothing forwarded the --preloader argument through to the device's preloader stage.

Example

mtk.py --preloader my_preloader.bin --plstage printgpt
mtk.py --preloader my_preloader.bin --plstage r boot vbmeta_a vbmeta_a.img

Changes

• mtk.py — register --plstage in add_exploit_group.
• mtkclient/Library/mtk_class.py — extract the
  parse_preloader → send_da → jump_da → re-init flow into
  Mtk.boot_preloader(). Reuses self.config so config.loader (the custom
  DA loader blob) is preserved across the new Mtk instance.
• mtkclient/Library/mtk_main.py:
  • cmd_peek now uses boot_preloader() instead of inlining the same flow.
  • New --plstage branch at the top of the generic DA/flash dispatch path,
    before DaHandler is built. script and multi are excluded because
    they manage their own boot flow.

Notes

• The extracted helper calls preloader.init() only when
  port.cdc.connected is false — both existing call sites already do their
  own init(), so re-running it would just close+reopen+re-handshake the
  USB pipe for no reason.
• Behavior for commands that already accept --preloader (peek, plstage)
  is unchanged.