Add in-toto metadata to python-tuf releases

Description of issue or feature request:
Project releases should include in-toto metadata that can be used to validate the integrity of the release's software supply chain.

Current behavior:
Developer signatures can be provided for each release of the project, both on GitHub and PyPI. However, these signatures do not guarantee that some part of the source->release process was
not compromised.

Expected behavior:
The packaged release should include metadata and a way to verify that the project was packaged as intended. All steps of the source->release procedure should be properly signed and confirmed to be valid, as defined by the project developers.

Inizia mappando la procedura source-to-release del progetto descritta nell’issue e studiando come vengono prodotti e verificati i metadati in-toto per i pacchetti Python. Il lavoro è completato quando le release includono metadati che coprono i passaggi della release, insieme a firme e a un modo documentato per confermare che il pacchetto sia stato prodotto come previsto.