Metadata API validation: validate root roles dictionary content

Spec says this about root roles:

A role for each of “root”, “snapshot”, “timestamp”, and “targets” MUST be specified in the key list. The role of “mirror” is OPTIONAL.

The reference to “key list” seems like a mistake (maybe referring to an earlier design?) but the intent seems clear: the roles dictionary is allowed to contain either the roles for ["root", "snapshot", "timestamp", "targets"] or the roles for ["root", "snapshot", "timestamp", "targets", "mirror"] (and I suppose we are not going to implement mirror for now)). Other roles are not valid and not having the first four roles is not valid.

It makes sense to validate this in Root construction/deserialization.

Aside/thought: maybe it also makes sense to validate in serialization but I think documenting that roles dict is not intended to be modified goes a long way.

[jku]

you don’t suggest doing that API change in this issue right?

I don’t: only reason to discuss these here is just in case they would make the validation obsolete… That doesn’t seem likely so let’s just forget it for now.

[MVrachev]

Okay, then I can fix this issue because it’s connected with another one I am already involved in #1356.