combine updater and tuf packages

[groob]

based on slack discussion:

If we merge #20, we're exposing the tuf client to the outside world, which increases the complexity of the implementation and state management somewhat.

We should merge the updater package into tuf, making the client private but allowing the caller to:

a) continuously monitor a specific target for changes
b) download a specific target based on current local repo metadata