Add in-toto metadata to python-tuf releases

Description of issue or feature request:
Project releases should include in-toto metadata that can be used to validate the integrity of the release's software supply chain.

Current behavior:
Developer signatures can be provided for each release of the project, both on GitHub and PyPI. However, these signatures do not guarantee that some part of the source->release process was
not compromised.

Expected behavior:
The packaged release should include metadata and a way to verify that the project was packaged as intended. All steps of the source->release procedure should be properly signed and confirmed to be valid, as defined by the project developers.

Comienza por trazar el procedimiento de source-to-release del proyecto descrito en el issue e investigar cómo se producen y verifican los metadatos de in-toto para paquetes de Python. El trabajo estará terminado cuando las releases incluyan metadatos que cubran los pasos de la release, junto con firmas y una forma documentada de confirmar que el paquete se produjo según lo previsto.