The repositoryId of an indexed extension can end up being null

Possible regression in one integration test.

Reopening: this change broke ExtensionSecurityIT#extensionVulnerabilitiesAdmin on every branch it was applied to.

Evidence (Develocity, CI builds):

• On stable-18.4.x, every build up to 6294babe (Oct 8) passes and every build from bb97ede0 (this issue's commit, Oct 9) fails. That is the only commit between the two.
• Since Oct 8, the test fails on master (29/42), stable-18.4.x (26/36) and stable-17.10.x (27/34), which are the branches with this change, and never on stable-18.8.x (0/11) or stable-16.10.x (0/17), which don't have it. On the main pipeline it had 0 failures in 266 runs between Sep 1 and Oct 7.
• Symptom: the Live Data of the Security Vulnerabilities administration stays empty (TableLayoutElement.waitUntilRowCountEqualsTo times out at ExtensionSecurityIT.java:70). Example: https://ci.xwiki.org/job/XWiki/job/xwiki-platform/job/stable-18.4.x/248/

Cause:

• ExtensionIndexStore#updateInstalled now uses updateIfExists, so the installed state is only written for extensions that are already indexed.
• An extension coming from a non searchable repository (here the Maven repositories of the test) is never indexed before it's installed, so its installed.namespaces field is never set.
• The security scan still creates the document through ExtensionIndexStore#update(ExtensionId, ExtensionSecurityAnalysisResult), with the CVEs but without the installed state.
• ExtensionSecuritySolrClient only lists documents having installed.namespaces (or flagged as core), so the vulnerable extension is filtered out.
• Users are probably affected too: a vulnerable installed extension is not listed unless that exact version is also indexed from a searchable repository. This has not been reproduced on a real instance.

Proposed fix: in ExtensionIndexStore#update(ExtensionId, ExtensionSecurityAnalysisResult), also call extensionIndexSolrUtil.updateInstalledState(extensionId, doc), as add(Extension) does. That way the document created by the security scan carries the installed state.

Verified locally on master (HSQLDB, Jetty standalone):