convert apkcache from pickle to JSON

pickle can serialize executable code, while JSON is only ever pure data.
The APK cache is only ever pure data, so no need for the security risks of
pickle.  For example, if some malicious thing gets write access on the
`fdroid update` machine, it can write out a custom tmp/apkcache which would
then be executed.  That is not possible with JSON.

This does just ignore any existing cache and rebuilds from scratch. That is
so we don't need to maintain pickle anywhere, and to ensure there are no
glitches from a conversion from pickle to JSON.

closes #163
3 jobs for drop-pickle-for-json in 18 minutes and 43 seconds (queued for 1 second)
Status Job ID Name Coverage
  Test
passed #94292416
lint_format_safety_bandit_checks

00:02:41

passed #94292415
metadata_v0

00:03:56

passed #94292414
test

00:18:43