repo-canary, refresh-timestamp-lambda, update-sign-tuf-repo: tough version bump

[etungsten]

Issue #, if available: Addresses #720

Description of changes:
Bumps tough library version from v0.3.0 to v0.4.0 for repo-canary, refresh-timestamp-lambda and update-sign-tuf-repo tools.

Testing done:
repo-canary still works locally:

$ repo-canary --metadata-base-url https://d25d9m6x9pxh9h.cloudfront.net/45efedef4afe/metadata/ --target-base-url https://d25d9m6x9pxh9h.cloudfront.net/45efedef4afe/targets/ --trusted-root-path ~/thar/PRIVATE-thar/packages/workspaces/root.json 
18:42:53 [ INFO] Loading TUF repo
18:42:54 [ INFO] Loaded TUF repo
18:42:54 [ INFO] Downloading 100% of listed targets
18:42:54 [ INFO] Downloading target: thar-devel.tar.lz4
18:42:55 [ INFO] Downloading target: thar-x86_64-aws-k8s-v0.2.0-root.ext4.lz4
18:43:00 [ INFO] Downloading target: thar-x86_64-0.1.6-root.ext4.lz4
18:43:04 [ INFO] Downloading target: manifest.json
18:43:05 [ INFO] Downloading target: thar-x86_64-aws-k8s-v0.2.0-root.verity.lz4
...

refresh-timestamp-lambda runs fine in my local account against my own TUF repo:

2020-02-14 18:52:34,918 INFO  [bootstrap] Parsing environment variables
2020-02-14 18:52:36,616 INFO  [bootstrap] Loading TUF repo
2020-02-14 18:52:43,220 INFO  [bootstrap] Updating version from 1581468594 to 1581706363
2020-02-14 18:52:43,220 INFO  [bootstrap] Updating expiration date from 2020-02-19T00:49:54.684219700+00:00 to 2020-02-21T18:52:43.220570927+00:00

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[tjkirch]

Would you please describe your testing in the PR description?

[etungsten]

Updated PR description with testing information.
update-sign-tuf-repo exercises the same tough library code paths as repo-canary and refresh-timestamp-lambda.

[zmrow]

🍖

[zmrow]

Added @webern