MetadataSetter does not enforce restriction on setting "tahoe" subkeys

[davidsarah]

When the metadata of a child in a directory is updated, the "tahoe" subkeys are not supposed to be changed. (This is not a security restriction, since someone with a writecap to the directory could bypass it; it's just desired behaviour for normal usage.)

This behaviour is enforced by Adder in source:src/allmydata/dirnode.py​ .

However, it is not enforced by MetadataSetter in the same file. Currently, MetadataSetter is only used by the set_metadata_for method of dirnodes, which is not accessible via the webapi. (The webapi set-children operation uses Adder.)

Either set_metadata_for should be considered for removal since it is not accessible, or MetadataSetter should have the same behaviour as Adder for "tahoe" subkeys.