Allow for null evr and archs on event history detail

For auto-installed packages from the activation key, evr and arch
are not available. buildPackageNevra handles evr and arch Id null
so if arch and evr are null, pass null to buildPackageNevra instead
of crashing.
Escape package name to prevent from script injection

Even though it seems to be impossible to inject a script as the package
name with the activation key packages form, it is probably still safer to
escape the string we get here.