deal with duplication of update-metadata

## Description

Having update-metadata duplicated in Bottlerocket and Twoliter is highly problematic because this is fundamental to how Bottlerocket operates. We probably need to publish this on crates.io.

> sources/updater/update_metadata
>
> Duplicating this makes me more than a little sad but I suppose in the short term it's unlikely to change given how difficult it us to evolve the format. It probably ought to be an independent crate, like `bottlerocket-os/bottlerocket-update-metadata`.

_Originally posted by @bcressey in https://github.com/bottlerocket-os/twoliter/issues/37#issuecomment-1692429512_

## Definition of Done

When `update-metadata` is no longer duplicated in both Bottlerocket and Twoliter.

Start by comparing the duplicated sources/updater/update_metadata implementations in Bottlerocket and Twoliter, then review the proposal to publish the shared code as an independent crates.io crate. Define how both projects would consume the shared format and verify that update-metadata is no longer duplicated in either project.

Written by the indexing model from the issue text.