adds updates.metadata functionality

Major questions:

1) when is the vdu checked when updates.metadata is called via a route? (It seems silly that the tests check the vdu *after* the update happens.)

2) How does one do integration tests on this code? Maybe I'm just missing a key piece of information, but how do we *know* that this code would be executed via /registry/_design/app/_updates/metadata/<pkg>?

cc: @isaacs