incompatibility with sqlalchemy 2.x

The sqlalchemy upgrade broke tooltool uploads: `check_pending_upload` would say "Upload of [hash] considered valid" but never actually seems to add the FileInstance to the db, so the uploaded file never becomes visible.

We reverted to 1.4.x (#1191), but we should probably look at fixing this (and. if I can dream, having better test coverage...).