Change securesystemslib.dsse.Envelope.signatures to dict upstream

[lukpueh]

          yeah, the TODO feels right -- even if the serialized format is a list, that's just `list(self.signatures.values())` away if self.signatures is a dict

Originally posted by @jku in #2436 (comment)

[lukpueh]

The upstream change has been merged but not released, so with-sslib-main tests are failing now.

Let's adopt the change here, and then wait for a new securesystemslib release before we release a new python-tuf.

[jku]

wait for a new securesystemslib release before we release a new python-tuf

so we don't want to make a python-tuf release that depends on securesystemslib < 0.32 first? that might be safest...

I'm thinking of others who may have made the same mistake I did in theupdateframework/tuf-on-ci#243: If we make python-tuf release first, no-one gets hurt I think