Use mypy to statically check sources

[jku]

We should start using mypy to check our sources statically. This implies also adding type annotations to functions. Doing this is useful for securesystemslib but doing this for public api is also useful for TUF (as TUF can then statically check the calls it makes to this API).

Configuring mypy and setting tox lint to run it (see theupdateframework/python-tuf#1395 for examples) should be easy, but it requires at least some parts of securesystemslib to be type annotated (#358)

See also Using mypy with an existing codebase