Split out TUF

[hasufell]

I'm a bit confused why TUF isn't its own library. It seems heavily intertwined here with cabal/hackage specific stuff, but the specification isn't. I wanted to use TUF in ghcup, but I can't see how I'd make use of hackage-security to achieve that.