tuf: Support importing root keys from a fioctl tarball

[doanac]

Add an optional --import-keys flag to the tuf-init command that reads a fioctl/ota-tuf tarball containing the offline root key(s) and root.json. The imported root.json files are stored verbatim, fresh online keys are generated for every role, and a new root.json is created and signed by both the imported (old) root key(s) and the new root key so clients can verify the chain of trust.

Chatting with Copilot on this, it was decided to be more efficient to use our own code for talking with the FIO backend for getting the root.json files rather than trying to integrate with the fioctl client library code.

Fixes bug #189

[doanac]

This has been tested e2e migrating a foundries factory device to my update server instance with the help of fioctl pr foundriesio/fioctl#541

[vkhoroz]

This looks good to me.

I'm only a bit surprised by a sheer amount of code needed to do this.
But that's irrelevant. You did a great job.

[vkhoroz]

LGTM

I'd still recommend to sort out that feeling of adding multiple old key signatures.
(That what the code seems to do, but we only ever have one matching old key in the tarball).

Feel free to merge when you like it.

[vkhoroz]

Maybe, use a multi-line format, like this:

Suggested change

	fmt.Println()
	fmt.Println("TUF initialization completed successfully.")
	fmt.Println()
	fmt.Println("IMPORTANT: A new root key was created at:")
	fmt.Printf(" %s\n", rootKeyPath)
	fmt.Println()
	fmt.Println("This key is encrypted at rest using the HMAC secret at:")
	fmt.Printf(" %s\n", hmacPath)
	fmt.Println()
	fmt.Println("Make a backup copy of BOTH files and store them somewhere safe NOW.")
	fmt.Println("The root key is useless without the HMAC secret needed to decrypt it.")
	fmt.Println("If either file is lost it CANNOT be recovered, and you will permanently")
	fmt.Println("lose the ability to rotate or manage your TUF root of trust.")
	fmt.Println()
	fmt.Printf(`
	TUF initialization completed successfully.
	IMPORTANT: A new root key was created at:
	%s
	This key is encrypted at rest using the HMAC secret at:
	%s
	Make a backup copy of BOTH files and store them somewhere safe NOW.
	The root key is useless without the HMAC secret needed to decrypt it.
	If either file is lost it CANNOT be recovered, and you will permanently
	lose the ability to rotate or manage your TUF root of trust.
	`,
	rootKeyPath, hmacPath)