updater: do not download package unless we know that it is approved

We do not download any package unless we know that they are going to be
installed with this commit. It is done by split of download to separate
function.