upgrade python-tuf dependency to 4.0+

although the tuf api changes don't appear to affect us on the repo side,
there is a breaking change in the client due to our use of the private tuf.ngclient.Updater_trusted_set

see theupdateframework/python-tuf@cb9aa4a

pyproject.toml

@@ -24,7 +24,7 @@ dependencies = [
     "packaging>=21.3",
     "securesystemslib[crypto,pynacl]>=0.26.0",
     "setuptools>=65.5.1",
-    "tuf==3.1.*",
+    "tuf==4.0.*",
     # constraints on sub-dependencies
     "certifi>=2022.12.7",
     "cryptography>=38.0.3",