[PSA] we now keep metadata.xml in overlays

[Mike Frysinger]

tl;dr: if you don't deal with ebuilds, then feel free to mosey on

the security team wants to start keeping track of CPE information
(which is a way to easily tie packages to CVEs). that information is
maintained in the metadata.xml file. that means when
cros_portage_upgrade runs, it will start pulling in metadata.xml for
you. you should also avoid manually deleting it when you see it in
the tree, or when doing a manual upgrade. in fact, in the manual
case, you should try to import it too.

the current metadata.xml penetration isn't that great, but we'll be
doing some scripting runs to suck things in bulk from upstream.
-mike