Signing multiple versions

[mnm678]

What does it mean for artifacts to be current? Unlike in many package managers, a new version does not necessarily replace the old version, so TUF needs to account for multiple valid versions of an artifact. Users can include all historical versions in their targets metadata, but this can get out of control for projects with thousands of previous releases, so we also want to encourage users to remove images from targets metadata at some point.

This issue is part of #2.