Make sure that listing patch updates does not do online update.

Listing patches is something we do on every run, so we don't want that
to hit the repository servers every time. In fact the
package_patch_list_command is not supposed to download anything, just
to list available patches from the local cache.
package_list_update_command is where the update should happen, which
is properly protected by timeouts.

Intentionally not ported to 3.5 branch, because at the time of
writing, core commit f861baa38 has not been ported to that branch,
which means it won't solve the problem anyway, and we prefer not to
rock the boat.