packagedb: use info/ files as authoritative source

Move over to using the individual files in info/ as an authoritative
source for package information, falling back to the packagedb.xml file
only in the case that we can't find such a file.

We no longer update the packagedb.xml file.

In order to ensure that we don't detect stale packagedb.xml entries as
installed packages, ensure that we only fall back to reading an entry
from that file if we are missing an info/ file but have a manifests/
file.

This commits removes caching of the packages in the _entries variable
and therefore also removes the code for statting in order to see if the
cache needs to be updated.  Since we no longer write to the file, we
also remove the need for locking.

https://bugzilla.gnome.org/show_bug.cgi?id=743127