ngclient: prevent using rolenames as filenames if they are dangerous #1562

Description of issue or feature request:
Delegation role names are not restricted in any way in the spec, but they are targets metadata role names.
This means they can be any random string. In Sigstore, for example, they are thinking of using delegations role names as URLs to avoid collisions (see #1527 (comment)).
We don't want to limit that behavior.

Still, using those role names as filenames is problematic (for both repository and client) as:

• not all strings are actually valid filenames - but the spec at times requires using the role name as a file name. Sanitizing the filename is difficult (as collisions must be prevented)
• Using those role names as filenames is also problematic because it can lead to path traversal with roles like ../../../filename. This is especially an issue for the client as role name is input from remote that should not be trusted more than is required
• There are no known security issues with arbitrary role names as files and version numbers, but the area seems ripe for them: is 1.role.json the metadata for the role role or the role 1.role?

Current behavior:
Currently, we are using role names as file names without any checks.

Expected behavior:
A possible solution could be validating that delegated role name:

• doesn't contain . and / in its name
• doesn't start with a number that can be misinterpreted as a metadata file name when consistent_snapshot is used.
  See: https://theupdateframework.github.io/specification/latest/#consistent-snapshots

I think the place where this validation should happen is before calling this Updater._download_metadata() here:

For context read: #152

This issue description is based on @jku comment here:
#1527 (comment)