signing-event: verify root_history contents

[jku]

Signing-event should verify a few things about root changes:

• existing files in root_history likely should never change (only new ones are added)
• when root.json changes, the new file should match the versioned one added in root_history/

These should be easy to check, I'm just not sure where: most validity checks are in CIRepository, like _validate_role() but that seems too low level: something like signing_event.py:status() might be a better place...