Add verify_external function

[heartsucker]

This would allow the director and image repo roles to share a place to store images while they keep their metadata separate.

[heartsucker]

There's actually enough different about Uptane that this isn't possible to implement here, but there should be a facility to allow the verification of random Read objects.

For example:

struct Tuf {
  fn verify_external<R: Read>(&self, target: &TargetPath, read: &mut R) -> Result<()>
}