[api] fix releaseing multibuild flavor via token

set_multibuild_flavor is now setting only the multibuild container
as the method name implies.

Doing so no matter if the package comes via a link or not, since it does
not matter for container name.

do not abort due to wrong guessed flavors because the wrong source state might be
read.

options[:package] can not be a string for releasing as it would crash
when trying to lookup the release name, so having a seperate string
for container name. (and to avoid the logic that it is a multibuild, if
it is not a package object)

simplify authorization object code