Keyfile portal fixes

We want to use the keyfile backend in sandboxes, but we want to avoid people losing their existing settings that are stored in dconf. Flatpak does a migration from dconf to keyfile, but only if the app explictly requests it.

From an app perspective, there are two steps to the dconf->keyfile migration:

1. Request that flatpak do the migration, by adding the migrate-path key to the metadata
2. Stop adding the 'dconf hole' to the sandbox

To keep us from switching to the keyfile backend prematurely, look at whether the app has stopped requesting a 'dconf hole' in the sandbox.