tough: metapath interpretation may need refinement

[webern]

In 1809b9b we added logic to sanitize role names and target names before they are used as filepaths or URL paths. However, in snapshots.json we store the raw (unsanitized) names as the METAPATH, which is defined as:

: METAPATH :: A string giving the file path of the metadata on the repository relative to the metadata base URL. For snapshot.json, these are top-level targets metadata and delegated targets metadata.

It's a bit unclear whether we should be storing the raw/unsanitized names or the 'resolved' names.