Prevent slow retrieval attacks about go-tuf

[lmars]

This is largely implemented in this commit (which is on the prevent-slow-retrieval-attacks branch).

However, the implemented timeoutReader has the side effect that if the given []byte is larger than chunkSize and the underlying reader returns partial data, those partial reads will be buffered until enough chunks have been read.

This may not be an issue, but it needs some thought, and probably needs testing against a real (and slow) HTTP server.

[titanous]

It looks like net/http's Request.Body.Close() could be dangerous here: golang/go#9662

Though I think it is easier to mitigate on the client side with CancelRequest.

[mnm678]

Slow retrieval attacks were removed from the TUF spec.