add GenericHolder.merge_lists().

The merge semantics might later be extended for non-list attributes, though
they should still be some kinds of collections.
extract the core of doPackageLists() to a private function.

The reason is this can simplify the inner working a lot if they are going to be
rewritten in the future (they are soon). This loses some performance benefit
coming from ORing together different name searches but I'd be about to drop this
with move to Subject anyway as the arguments can mean vastly different things,
not just names.