Add in-toto metadata to python-tuf releases

Description of issue or feature request:
Project releases should include in-toto metadata that can be used to validate the integrity of the release's software supply chain.

Current behavior:
Developer signatures can be provided for each release of the project, both on GitHub and PyPI. However, these signatures do not guarantee that some part of the source->release process was
not compromised.

Expected behavior:
The packaged release should include metadata and a way to verify that the project was packaged as intended. All steps of the source->release procedure should be properly signed and confirmed to be valid, as defined by the project developers.

Beginne damit, die im Issue beschriebene Source-to-Release-Prozedur des Projekts abzubilden und zu untersuchen, wie in-toto-Metadaten für Python-Pakete erzeugt und verifiziert werden. Die Aufgabe ist abgeschlossen, wenn Releases Metadaten enthalten, die die Release-Schritte abdecken, sowie Signaturen und eine dokumentierte Möglichkeit, zu bestätigen, dass das Paket wie vorgesehen erzeugt wurde.