Use pkcon instead of rpm for package queries

Killing rpm after timeout can cause package database corruption and/or
keep the db locked. If pkcon timeouts for whatever reason, only the
client is killed, leaving packagekitd, which is in fact accessing the
database, running.