Add a test that, instead of overriding trusted keys with environment
variables, actually initializes a TUF cache using a local TUF mirror.
This will prepare us to safely make changes to the TUF client.

Metadata for the public good instance goes through a different code
path, since those keys are embedded in the code. We can't test signing
and verifying with the public good instance hermetically, so we rely on
conformance tests to catch issues with that path.

Signed-off-by: Colleen Murphy <[email protected]>

Signed-off-by: Colleen Murphy <[email protected]>