Move upgrade.py into libup package, use local db instead of scraping

We now have a database (using the term loosely) of repos plus the
packages they have, so use that instead of scraping Gerrit for file
contents.

We're also now sharing a consistent requests session almost everywhere,
and should be able to share a lot more code.

Change-Id: I26d2f39db89da20545c2ca19b223457ee0dac01c