ngclient: type annotations review and mypy integration

[jku]

ngclient type annotations are not complete: once mypy is in use (#1395), we should

• enable mypy for ngclient
• fix any annotation issues

[jku]

I was planning to handle this but will push forward: this makes sense after both #1408 and #1455 are merged.

[sechkova]

I had partial success when trying to enable mypy for ngclient: #1489

Two main issues remain:

1. mypy cannot figure out our intentions to instantiate Signed subclasses
2. mypy considers some values as potentially "None" at places where we think we have ensured that this is not possible (esp in trusted_metadata_set where we know the state but mypy doesn't)

see https://github.com/theupdateframework/tuf/pull/1489/checks?check_run_id=3028663485

The first issue could be resolved by #1457 or by adding type hints for all attributes missing in the base class (doesn't feel so great). While the second one probably requires case by case decisions.