Fix duplicate signature validation
Fix duplicate signature validation

When role thresholds are used, it is required that the multiple signatures come
from different keys. It should not be possible for one role to just sign the
metadata twice.

Previously, the check was on the _value_ of the signature, but this is
meaningless when signatures are non-deterministic or when an attacker can craft
two signatures that serialise differently. The correct check is to compare
keyids: these come from root.json, and attackers can't create new ones at
random.

advancedtelematic/aktualizr,advancedtelematic/aktualizr,advancedtelematic/aktualizr,advancedtelematic/aktualizr,advancedtelematic/sota_client_cpp,advancedtelematic/sota_client_cpp