Fix upgrade process when apps enabled for specific groups

Fix issue where the currently logged user was causing side-effects when
upgrading.
Now setting incognito mode (no user) on update to make sure the whole
apps list is taken into account with getEnabledApps() or isEnabled().

Fixes #10762 
Fixes #10650 

TODO:
- [ ] unit test for `getEnabledApps()`
- [ ] unit test for `needsUpgrade()`
- [ ] acceptance test (if possible) to verify whether an app enabled with group correctly appears