Fix upgrade process when apps enabled for specific groups

Fix issue where the currently logged user was causing side-effects when
upgrading.
Now setting incognito mode (no user) on update to make sure the whole
apps list is taken into account with getEnabledApps() or isEnabled().

Fixes #10762 
Fixes #10650 

TODO:
- [x] unit test for `getEnabledApps()`
- [x] unit test for `needsUpgrade()`
- [x] acceptance test (if possible) to verify whether an app enabled with group correctly appears