[policy] Add php-tuf/php-tuf to core governance — for experimental Automatic Updates & Project Browser modules

This should either be turned into a policy issue, or closed.

php-tuf/php-tuf has no purpose in core by itself; its only use is as a dependency of 📌 Add php-tuf/composer-integration to core dependencies and governance — for experimental Automatic Updates & Project Browser modules Needs work . It should be kept as an indirect dependency, rather than added directly to core. However, I would recommend keeping it as a direct dependency drupal/core-recommended.

I wonder if we should just merge this into 📌 Add php-tuf/composer-stager to core dependencies and governance — for experimental Automatic Updates & Project Browser modules Needs work since likely we'll want to do the same thing. I have the same general concerns as in #3331078-55: Add php-tuf/composer-stager to core dependencies and governance — for experimental Automatic Updates & Project Browser modules → here too.