docs: document TUF design decisions

**Description**

The current signers, thresholds etc will be documented by the system automatically from tuf-on-ci 0.10 onwards but we should include a note in README about the design decisions:
* why have N signers for root
* why root expiry is X but targets is Y
* same for timestamp and snapshot
* why there is only a single online key 
