Metadata API: validate that "paths" or "path_hash_prefixes" is set

[MVrachev]

Description of issue or feature request:
As @sechkova have pointed out in this comment #1463 (comment) in DelegatedRole we are checking if paths and path_hash_prefixes BOTH are set, but we aren't checking
if at least one of them is set:
https://github.com/theupdateframework/tuf/blob/24fa1128116429dc18e185047fbffb009ca509b0/tuf/api/metadata.py#L914

For more context read theupdateframework/specification#156.

Current behavior:
We don't check if BOTH paths and path_hash_prefixes are None.

Expected behavior:
Check if BOTH paths and path_hash_prefixes are None.

[jku]

I don't think there's a clear consensus that that is the expected behaviour theupdateframework/specification#156

I thought paths=None, path_hash_prefixes=None was legal and means "I want to delegate everything" as otherwise that wouldn't be possible at all (well path_hash_prefixes=[""] probably would delegate everything but seems even more like a hack). I don't think there's much in the spec to support either stance.

[joshuagl]

Let's implement something which replicates the behaviour of the current client until the specification better defines what is expected.

[sechkova]

Let's implement something which replicates the behaviour of the current client until the specification better defines what is expected.

Done with 2159b88.