Add constraint for tuf

[cdce8p]

Proposed change

securesystemslib==1.0 was released today which contains breaking changes.
That lib is required by tuf. However, that lib isn't updated yet. Therefore they added a <1.0 constraint in v4. For some reason uv seems to prefer the latest version of securesystemslib over tuf which causes the issue.

Adding the constraint forces the correct resolution.

Reverse dependency graph:

securesystemslib==1.0.0
├── sigstore==1.0.0 [requires: securesystemslib]
│   └── aiogithubapi==23.11.0 [requires: sigstore<2]
└── tuf==3.1.1 [requires: securesystemslib>=0.26.0]
    └── sigstore==1.0.0 [requires: tuf>=2.0.0]
        └── aiogithubapi==23.11.0 [requires: sigstore<2]

With constraint

securesystemslib==0.31.0
├── sigstore==1.0.0 [requires: securesystemslib]
│   └── aiogithubapi==23.11.0 [requires: sigstore<2]
└── tuf==4.0.0 [requires: securesystemslib>=0.26.0,<0.32.0]
    └── sigstore==1.0.0 [requires: tuf>=2.0.0]
        └── aiogithubapi==23.11.0 [requires: sigstore<2]

https://github.com/secure-systems-lab/securesystemslib/blob/v1.0.0/CHANGELOG.md#securesystemslib-v100
https://github.com/theupdateframework/python-tuf/releases/tag/v4.0.0

Failing workflow: https://github.com/home-assistant/core/actions/runs/8923946566/job/24510216051

...
venv/lib/python3.12/site-packages/tuf/api/metadata.py:59: in <module>
    from securesystemslib.util import persist_temp_file
E   ModuleNotFoundError: No module named 'securesystemslib.util'
=========================== short test summary info ============================
ERROR tests/components/github - ModuleNotFoundError: No module named 'securesystemslib.util'

Type of change

• Dependency upgrade
• Bugfix (non-breaking change which fixes an issue)
• New integration (thank you!)
• New feature (which adds functionality to an existing integration)
• Deprecation (breaking change to happen in the future)
• Breaking change (fix/feature causing existing functionality to break)
• Code quality improvements to existing code or addition of tests

Additional information

• This PR fixes or closes issue: fixes #
• This PR is related to issue:
• Link to documentation pull request:

Checklist

• The code change is tested and works locally.
• Local tests pass. Your PR cannot be merged unless tests pass
• There is no commented out code in this PR.
• I have followed the development checklist
• I have followed the perfect PR recommendations
• The code has been formatted using Ruff (ruff format homeassistant tests)
• Tests have been added to verify that the new code works.

If user exposed functionality or configuration variables are added/changed:

• Documentation added/updated for www.home-assistant.io

If the code communicates with devices, web services, or third-party tools:

• The manifest file has all fields filled out correctly.
  Updated and included derived files by running: python3 -m script.hassfest.
• New or updated dependencies have been added to requirements_all.txt.
  Updated by running python3 -m script.gen_requirements_all.
• For the updated dependencies - a link to the changelog, or at minimum a diff between library versions is added to the PR description.
• Untested files have been added to .coveragerc.

To help with the load of incoming pull requests:

• I have reviewed two other open pull requests in this repository.

[bdraco]

Thanks @cdce8p