Extend MetadataEntry with signatures

[edsko]

In the index log, we currently use

data TarIndexEntry = ... | MetadataEntry !PackageId !RevisionNo !UTCTime

However, once we start signing packages, we cannot recreate these TUF files so easily anymore because we do not have the keys to generate the signatures.