Tests: Add testing to detect rollback attacks by using prior state

[asraa]

Description

Right now, we test against client states that just include initial/recent roots.

We should also be testing with clients that have some recent state, e.g. a prior root-signing: this way we can detect roll-back attacks, and would have detected the version issue https://github.com/sigstore/root-signing/pull/327/files

Detected in #410

cc @joshuagl

[jku]

current preprod test (test.yml) has a TUF client test that has two modes

• a pristine client (client with initial root.json updates from preprod)
• client upgrade (client with initial root.json updates from prod and then updates from preprod)