updater: Rolling out new images

[lmars]

First we need to make sure images have associated tarsums, see #612.

Then:

• [ ] Use an S3 backed tuf repository for version manifests (initial Go implementation here)
• [ ] Add the generated image manifest (including tarsums) to the tuf repo (possibly embedded in the release manifest)
• [ ] Create an updater binary which takes a tuf root key, downloads the image manifest and passes it off to flynn-host download (or downloads images itself)

Part of #276.

[lmars]

Due to some concerns with the initial plan (e.g. Tarsum insecurities), our intended approach has changed to the following:

• [x] Replace flynn-release upload with flynn-release export which uses d2r to export all images (i.e. layers / metadata / ancestry) to a local registry-style hierarchy
• [x] Implement a command which will add the exported images to a local tuf repository (e.g. tuf import <dir>)
• [x] Upload the tuf repository to S3 as part of creating a release
• [x] Add "fetchers" to pinkerton to support fetching images from either a Docker registry or a tuf repository
• [ ] Modify flynn-download to use the tuf repository fetcher