Metadata update needs better Ok/Err logic

[heartsucker]

Currently the outcomes of updating are:

1. Things are ok, we did an update.
2. Things are ok, we did not update.
3. Everything is borked and on fire.

Return should be:

1. Update happened, we are in a legal state.
2. Update did not happen, we are in a legal state.
3. We are in an illegal state.

For example, it may be reasonable for this to happen:

• Update local root to v1
• Update local timestamp to v1
• Update local snapshot to v1
• Update local targets to v1

Then

• Try to update remote timestamp to v2, but fail
• Continue anyway because the TUF internal state is consistent