fix new 'releases' key in legacy json api

stub for test was completely hosed:
  - missed return type of list
  - missed explody `datetime.date` object

thus implementation failed to stringify the `upload_time` value for all urls in `releases`

failure here was because of the bad stub, as well as "testing" against a local DB with no files. It might help to have some fixtures for populating a few packages in a database as well as a file system.