GHSA-3633-5h82-39pq: Go-tuf Improperly handles multiple key IDs for the same public keys in attacker-controlled metadata

While the impact is potentially high, the severity is low as it requires either attackers or the repository (deliberately or mistakenly respectively) to have produced such an incorrect distribution of public keys, causing clients < 0.3.2 to fall prey to this issue.