Separate custom metadata into user-specified and tufup-internal

[dennisvang]

Internally, the custom metadata object is separated into a user object and a tufup object.

Casual users of tufup should not notice any difference:

• the representation in targets.json is changed (see example below)
• the existing public interface (repo side and client side) is not changed:
  • the TargetMeta.custom attribute is replaced by a custom property, which handles backward compatibility
  • the internal custom metadata can be accessed via the new TargetMeta.custom_internal property.

Examples

On the repo side (same as before):

...
repo.add_bundle(
    new_version='2.3.4',
    new_bundle_dir='dist/myapp',
    custom_metadata=dict(foo='bar'),  # optional
)
...

The custom metadata ends up in the targets.json file as follows (different from before):

{
  "signatures": [
    "..."
  ],
  "signed": {
    "...": "...",
    "targets": {
      "...": {},
      "myapp-2.3.4.tar.gz": {
        "custom": {
          "tufup": null,
          "user": {"foo": "bar"}
        },
        "hashes": {
          "sha256": "..."
        },
        "length": 12345
      },
      "...": {}
    }
  }
}

On the client side, this metadata is made available via the TargetMeta class. Note that Client.check_for_updates() only ever returns a TargetMeta instance for the archive, regardless of whether a patch update or a full update will be performed.

For example (same as before):

...
new_archive_meta = client.check_for_updates()
if new_archive_meta:
    ...
    if new_archive_meta.custom:
        ...

fixes #99