updater: do not download package unless we know that it is approved

We do not download any package unless we know that they are going to be
installed with this commit. It is done by split of download to separate
function.
6 jobs for memory-ups in 3 minutes and 38 seconds (queued for 3 seconds)
Status Job ID Name Coverage
  Test
passed #240639
cppcheck

00:00:31

passed #240640
luacheck

00:00:29

passed #240637
system-tests

00:01:00

passed #240638
system-valgrind-tests

00:03:38

passed #240635
unit-tests

00:00:52

passed #240636
unit-valgrind-tests

00:03:19