Deploy rugged for TUF signing to production

Remaining tasks

• Decide and document security stance - root key handling, anything that is an option in how we use TUF
• Set up production-grade hosting of rugged - #3325040: [Packaging Pipeline] Securely sign packages hosted on Drupal.org using the TUF framework and Rugged is tracking known issues in Rugged
• Add to packaging pipeline - #3325040: [Packaging Pipeline] Securely sign packages hosted on Drupal.org using the TUF framework and Rugged built out initial work

Deployment

• Set up Rugged in production
• Add drush drupalorg-release-send-rugged to packaging pipeline
• Set up packages.drupal.org/metadata hosting - site/profile/files/webnode/static/staging/packages.staging.devdrupal.org.conf in the internal Puppet tree has a draft. A crucial special header is Surrogate-Key tuf, so the CDN cache can be cleared
• Add /metadata path to VCL configuration, also following the staging configuration
• Set up cron to run https://git.drupalcode.org/project/infrastructure/-/blob/main/rugged-int... every minute
• Set up cron to run drush drupalorg-release-send-rugged examples --version=3.x-dev every 12h
• Backfill signing for all projects