factoring out Repository implementations into separate crates

[erickt]

We haven't quite figured out our rust https story on fuchsia, but one of the options we are considering is to have a dedicated service managing web requests. If that's the case, we won't necessarily need hyper+some tls in the tuf repo. If that's the case, it'd be nice if we could build the core tuf library without it.

[faern]

It would indeed be nice with a Rust TUF crate that only implements the metadata/role verification and parsing. Not the actual IO, since this makes the library locked to one http client and async runtime.