feat(ngclient): require explicit bootstrap argument

[1seal]

Description of the changes being introduced by the pull request:

This PR makes the trust anchor choice explicit in tuf.ngclient.Updater().

• bootstrap is now a required keyword-only argument (no default)
• Callers must choose:
  • bootstrap=<root_bytes> (recommended: embedded/deployed trusted root)
  • bootstrap=None (explicit opt-in to using cached metadata_dir/root.json as the trust anchor)
• The fallback now triggers only on bootstrap is None (not on falsy bytes)
• Tests and examples are updated to pass bootstrap explicitly
• Adds documentation guidance on secure bootstrap root storage

Migration:

• Old implicit behavior: Updater(...)
• Preserve old behavior explicitly: Updater(..., bootstrap=None)
• Recommended: Updater(..., bootstrap=)

Tests:

• python -m pytest -c pyproject.toml -q

Ref: GHSA-9pfj-pjv5-22gj