Transfer: Hide transfer metadata link if none

refs #7209

Previously, a TransferMetadataSet was created for every Transfer, even
though it was only needed by Disk Image transfer types. It was updated to
only create a TransferMetadataSet (and therefore transfermetadatasetrow)
when needed, which broke rendering the link to the transfer metadata form.
Update to only display the transfer metadata link if it exists.
databaseInterface: support passing argument tuples

These allow values to be passed into SQL statements without interpolating
them into the string, preventing possible SQL injection issues.
For example:

sql = """SELECT * FROM fpr_formatversion WHERE uuid='%s'""".format(uuid)
databaseInterface.queryAllSQL(sql)

Could be run as:

sql = """SELECT * FROM fpr_formatversion WHERE uuid=%s"""
databaseInterface.queryAllSQL(sql, (uuid,))

Since the values are inserted here without string interpolation, there
is no risk of quoting issues or SQL injection regardless of the contents
of the values.

Fixes #4901.
emailFailReport: don't interpolate values into SQL

The HTML document being embedded can contain single quotes.

Fixes #7208.
databaseFunctions: convert to use SQL parameters

refs #4901