[api] refactor project#update_from_xml to make it more modular

The goal is to parse the repositories twice, once save only those
that work and then another pass to get the repos matching against it.

This of course opens the question how long should we do that - i.e.
how many levels of nested repos do we support, but I guess if we survived
with only one level so far, supporting two will do for another decade