Clarify optional attributes

[MVrachev]

This pr merges changes from #157, #158, and #162 into one for an easier review process and
merging (considering we have to bump the version on each merge)
and closes #156.

This pr makes three changes

• make delegations optional
• make consistent_snapshot optional
• clarify which of paths and path_hash_prefixes can be used and when

Nowhere in the spec, we clarify that delegations is an optional field
in the targets, metadata file which is implied by the file format scheme showed for targets here.

From chapter 6.2.1 in the tuf specification (version 1.019)

Finally, the root metadata should write the Boolean
"consistent_snapshot" attribute at the root level of its keys of
attributes.
If consistent snapshots are not written by the repository,
then the attribute may either be left unspecified or be set
to the False value. Otherwise, it must be set to the True value.

The above implies that there could be repositories with root metadata
without CONSISTENT_SNAPSHOT.
Clarify that, but phrase it so it's clear this should be included
in new implementations.

Finally, clarify paths and path_hash_prefixes in delegations, because
currently, it's not properly defined which of these options can be used
to create a valid target file:

• BOTH paths and path_hash_prefixes
• ONLY ONE of paths and path_hash_prefixes
• NONE of paths and path_hash_prefixes

With this change, I aim to define clearly that a valid target file will
contain ONLY ONE or NONE of them.

[MVrachev]

While working on TUF I noticed that in TUF we have hardcoded a role2.json file (which is a delegation of role1.json which on another hand is delegated in targets.json) not without delegations at all,
but with empty keys dict and roles list. You can see the file here: https://github.com/theupdateframework/tuf/blob/develop/tests/repository_data/repository/metadata/role2.json

Is that what you meant by this in the spec here:

PS: Tagging people who I hope have the historical context: @trishankatdatadog, @joshuagl.

[trishankatdatadog]

While working on TUF I noticed that in TUF we have hardcoded a role2.json file (which is a delegation of role1.json which on another hand is delegated in targets.json) not without delegations at all,
but with empty keys dict and roles list. You can see the file here:

Good catch. Seems weird, but shouldn't be illegal.

[mnm678]

@MVrachev can you set the version to 21

[mnm678]

21

actually, can you make it 22