dependencies: start depending on released versions

[jku]

Currently we have dependencies using main git branches or specific commits. Goal should be:

• use only versioned releases from pypi.org
• if dependencies do not have releases we need, make sure they happen

This is mainly about tuf, sigstore and securesystemslib

[jku]

Current state:

• tuf: last release was in may, we almost certainly need a new one
• securesystemslib: last release mid april, does not contain AzureSigner at least
• sigstore: currently only a specific commit is compatible (see #112). sigstore needs a new release, then securesystemslib needs to get modified to use that release, then we should use those releases

[jku]

moved to tuf-on-ci