Synchronization logic for exported API

[jonasfj]

We identified 3 cases where we want to sync:

• (A) Full daily background sync.
• (B) Immediate sync after a package version has been published.
• (C) When Package.updated is changed.

Leveraging the fact that Bucket.list from package:gcloud now returns ObjectInfo, we can do synchronizePackage such that it:

• Updates advisories,
• Updates version listing response,
• List all versions from TarballStorage and takes the versions visible in version listing and uses synchronizeTarballs.

In the case where there is nothing to update, this should do:

• datastore lookup of Package,
• datastore query for PackageVersion entities,
• Cache lookup for advisories.
• 2 HEAD requests to GCS for advisories and version listing (to confirm content haven't changed using md5Hash).
• A bucket.list request to canonical bucket using TarballStorage.
• Two bucket.list requests to exported API bucket to confirm that archives exported match those from TarballStorage.

All in all, I think that's actually fairly efficient.

[isoos]

Nit: should we log the fact of deletion (here and elsewhere)? Maybe for a cursory later verification that we are not doing something stupid...