Add type annotations to download.py and fetcher.py

Run mypy with --install-types and --non-interactive
options to install all suggested stub packages.
In our case this is the stub for the requests package.

Include urllib3 to the ignored imports.

Signed-off-by: Teodora Sechkova <tsechkova@vmware.com>

Author: sechkova

setup.cfg

@@ -22,3 +22,6 @@ files =
 
 [mypy-securesystemslib.*]
 ignore_missing_imports = True
+
+[mypy-urllib3.*]
+ignore_missing_imports = True

tox.ini

@@ -51,6 +51,6 @@ commands =
     # work, unfortunately each subdirectory has to be ignored explicitly.
     pylint -j 0 tuf --ignore=tuf/api,tuf/api/serialization,tuf/ngclient,tuf/ngclient/_internal
 
-    mypy
+    mypy --install-types --non-interactive
 
     bandit -r tuf

tuf/ngclient/_internal/requests_fetcher.py

@@ -7,7 +7,7 @@
 
 import logging
 import time
-from typing import Iterator, Optional
+from typing import Dict, Iterator, Optional
 from urllib import parse
 
 # Imports
@@ -31,7 +31,7 @@ class RequestsFetcher(FetcherInterface):
             session per scheme+hostname combination.
     """
 
-    def __init__(self):
+    def __init__(self) -> None:
         # http://docs.python-requests.org/en/master/user/advanced/#session-objects:
         #
         # "The Session object allows you to persist certain parameters across
@@ -46,7 +46,7 @@ def __init__(self):
         # improve efficiency, but avoiding sharing state between different
         # hosts-scheme combinations to minimize subtle security issues.
         # Some cookies may not be HTTP-safe.
-        self._sessions = {}
+        self._sessions: Dict[str, requests.Session] = {}
 
         # Default settings
         self.socket_timeout: int = 4  # seconds
@@ -146,7 +146,7 @@ def _chunks(
         finally:
             response.close()
 
-    def _get_session(self, url):
+    def _get_session(self, url: str) -> requests.Session:
         """Returns a different customized requests.Session per schema+hostname
         combination.
         """