Verify delegated target paths in repository_tool.py.

repository_tool.py verified that valid metadata was written, properly signed, hashes all matched, and required roles created.  The only check missing was verification of delegated target paths according the parent's delegations.  Now, target paths are validated before write() is called for both 'path' and 'path_hash_prefixes'.  updater.py has always properly verified paths, only repository_tool.py needed the support.  If any of the delegated paths are not allowed, write()
raises the following exception:
tuf.ForbiddenTargetError: Role 'targets/unclaimed' specifies target '/simple/bad_file.txt', which is not an allowed path according to the delegations set by its parent role.