Proof of concept implementation of The Update Framework (TUF).

This allows a gem to be published with TUF metadata, and to be fetched
securely using a custom fetch script.

See the README for details of getting it running. This requires https://github.com/rubygems/rubygems/pull/719 to be checked out alongside this repository.

```
> script/fetch-me-a-gem-with-tuf cane
cache miss: metadata/timestamp.txt
cache miss: metadata/release.0aa4ee2b00d39a4a1db21c0811f8c2c8de406b7cfac362504276f324e485b0b5.txt
cache hit: metadata/targets.2372d612fb24776e928af5af8a0ab924c046cefe265885cc6011b346ba8c3bd3.txt
cache hit: metadata/targets/claimed.f1095e1b16f935dff02f178ded5b0b8e0986cfa89c402ec8d1eb20475abde25d.txt
cache hit: metadata/targets/recently-claimed.3fa663ba393d90c519403eaa97cfa8f2ad5bfb98022fa4426438f2d9526adaee.txt
cache miss: metadata/targets/unclaimed.cabf35a8f5713ed399847c61a2ea9f1beab4fa0667d987ee41b06228114c51e9.txt
cache miss: ./latest_specs.4.8.a1c235ed3d94b6a2897f92c528c38fe14e1594de4f53a6821767c82091c2862d.gz
cache hit: metadata/targets.2372d612fb24776e928af5af8a0ab924c046cefe265885cc6011b346ba8c3bd3.txt
cache hit: metadata/targets/claimed.f1095e1b16f935dff02f178ded5b0b8e0986cfa89c402ec8d1eb20475abde25d.txt
cache hit: metadata/targets/recently-claimed.3fa663ba393d90c519403eaa97cfa8f2ad5bfb98022fa4426438f2d9526adaee.txt
cache hit: metadata/targets/unclaimed.cabf35a8f5713ed399847c61a2ea9f1beab4fa0667d987ee41b06228114c51e9.txt
cache miss: quick/Marshal.4.8/cane-2.6.3.gemspec.807cd0070ffa50f7b4ff8acb7723cce47734796a36a5bebf1208e3a79ad7cbfb.rz
cache hit: metadata/targets.2372d612fb24776e928af5af8a0ab924c046cefe265885cc6011b346ba8c3bd3.txt
cache hit: metadata/targets/claimed.f1095e1b16f935dff02f178ded5b0b8e0986cfa89c402ec8d1eb20475abde25d.txt
cache hit: metadata/targets/recently-claimed.3fa663ba393d90c519403eaa97cfa8f2ad5bfb98022fa4426438f2d9526adaee.txt
cache hit: metadata/targets/unclaimed.cabf35a8f5713ed399847c61a2ea9f1beab4fa0667d987ee41b06228114c51e9.txt
cache miss: gems/cane-2.6.3.0eab3cf91e486649d4b2d39518d15c6bf5f350f9f8201f971b76c2d0327e1f37.gem
Downloaded gems/cane-2.6.3.gem and quick/Marshal.4.8/cane-2.6.3.gemspec.rz
```

Still a lot of work remains. Some of the bigger items:

* Numerous TODOs in code.
* Support thresholds.
* Support timestamps and expiry.
* New endpoint allowing developers to uploaded targets for their gems,
  delegating to them from recently-claimed role.
* Ability for maintainers to easily promote recently-claimed to claimed.
* Move/integrate most of the TUF code to rubygems client, since it is needed to
  fetch gems using the framework.
* Integrate fetching code into actual gem CLI.
* Bundler support.
* Test coverage.
* Update code base to work with latest ruby/rubygems.
* Document emergency procedures, such as re-issuing root.txt.
* High-level documentation tying this implementation to the spec.
* Establish the manual procedure and key distribution for updating the
  claimed role.
* Import process for all existing gems.

@tarcieri @nealharris @jkingdon @justine-square @sandersch (note: this is pretty different from the last code I showed you - pretty sure I've settled down on the architecture now.)

References:
* https://github.com/theupdateframework/pep-on-pypi-with-tuf
* https://updateframework.com/projects/project
* http://mirror1.poly.edu/test-pypi/