Fix packagemeta::ScanDownloadedFiles

Fix packagemeta::ScanDownloadedFiles

packagemeta::scan clears the site list if the package was not found, and
packagemeta::ScanDownloadedFiles uses packageversion::accessible() to check
that.

Instead communicate via a return value

v2:
empty packages were always inaccessible, even though we returned early from
scan() without clearing the sites list, so return false in that case