do not assume `app` is an App instance, support API usage
When using fdroidserver methods as an API, the full setup might not have taken place. app
instances can always just be a dict, the App
class is mostly just a typing shortcut. This is incremental, it only affects a couple of functions in fdroidserver/update.py.