do not assume `app` is an App instance, support API usage
When using fdroidserver methods as an API, the full setup might not have taken place.
app instances can always just be a dict, the
App class is mostly just a typing shortcut. This is incremental, it only affects a couple of functions in fdroidserver/update.py.