flatpak: don't crash on elsewhere consumed streams

this is effectively the same problem as we have in packagekit: we create
streams and call into them at a later point in time but at the same time
we return raw pointers out of the search function, practically giving up
control over the life time of the pointer because streams are
delete-on-finish constructs so if our caller finishes the stream early
(e.g. because of a cancel condition) the stream disappears out from
under us.

weak point to the streams using QPointer and check at relevant points in
time

this should fix all race condition crashes we see in 6.0 in the flatpak
backend