[aaronlew02]

Summary

This change extracts the TUF engine (including the updater, provider, models, and verifiers) into its own :sigstore-tuf module.

[loosebazooka]

going through this now, worth fixing the dependency version drift in the meantime... alternatively we could explore using a version catalog to prevent this issue.

[loosebazooka]

We need to update our module test for this new module. It seems like there may be some conflicting packages (SigstoreTufClient might need to move to a different package).

[aaronlew02]

• Moved SigstoreTufClient from dev.sigstore.trustroot to new dev.sigstore.trustroot.tuf
• Moved Sigstore TUF roots from src/main/resources/dev/sigstore/tuf to src/main/resources/dev/sigstore/trustroot/tuf
• Added a TargetReader field to SigstoreTufClient to keep getTargetStore() and getMetaStore() package-private in the TUF Updater
• Declared api("com.google.code.gson:gson:2.14.0") dependency in sigstore-tuf
• Added sigstore-tuf to sandbox (module-test)
• Moved TestResources from sigstore-tuf/src/test/java/dev/sigstore/testkit/tuf/ to sigstore-tuf/src/test/java/dev/sigstore/tuf/
• Updated sigstore-tuf dependencies