allow from_compose by CID, use get_release, update fedfind dep
fedfind get_release() now handles URLs and CIDs, and the
get_release_cid() and get_release_url() functions are only
thin wrappers for backwards compat, so stop using them here
so I can remove them in future. Also allow specifying the 'from'
release by compose ID as well as URL, and update the fedfind
requirement in setup.py.