tuf and securesystemslib must be vendored

[jku]

pip dependencies must be vendored.

In the short term testing the TUF integration with a manually installed TUF works fine but even here there is a practical issue: I don't know how to get the test suite to run with tuf code.

This is currently prevented by
theupdateframework/python-tuf#1160

[jku]

Oof, this is much more prevented by theupdateframework/python-tuf#1165 At least that's what it looks like