Metadata verification API tweaks

I’d like the API to handle all signature/hash verifications that it can (so that there’s a single place that’s considered “reference implementation”).

I’d also like these to be consistent and easy to use correctly (and hard to use incorrectly). I’m filing this as an umbrella issue since this is harder to do bit-by-bit…

Issues:

• signature verification with threshold does not exist #1306
• target hash verification is not implemented #1361
• metadata hash verification is not implemented #1361
• it’s not obvious how to use verify() (it returns a bool but multiple people have used the API incorrectly already, assuming it raises an exception) This doesn’t mean it needs to raise: the issue could be fixed by renaming to is_verified() or even is_signed()
• the amount of different exceptions from verify is obnoxious #1351

[sechkova]

* sig verification and and the sig verification with threshold creates an annoying imbalance (in first case we ask metadata if it itself is signed, in second case we plan to ask metadata if _some other_ metadata is signed with threshold of keys). Good naming helps but alternatively we could move sig verification to Key object

Do we even need metadata to both verify itself and be able to verify other metadata? I think we should stick to one of the options. If the common agreement is towards metadata.verify_delegate_threshold_of_signatures() then probably we can get by without metadata.verify as a public method and add a helper/wrapper of sslib.verify_signature() if needed.

Feels like this question links to #1306

[jku]

Looks all done to me!