packagekit: attach timer to stream rather than backend

this ensures the timer gets resolved as part of stream deletion (if it
happens before the timer timeouts anyway).

(cherry picked from commit 3aba158a)