libdpkg: Handle missing Version when formatting source:Upstream-Version

When dealing with virtual packages (such as the ones from Provides, or
for not-installed Recommends or Suggests), there might be no version
field at all, so we cannot assume we can use these when filling in the
version information in the fallback code handling the missing Source
field.

The commit that removed the check for not-installed packages missed that
this instance had not been protected, as the code in varbufversion() is
doing the correct thing, but unfortunately we are not using that because
we need to get at the upstream part, so we need to also check explicitly
for a non-NULL upstream part. This was causing a segfault.

Fixes: commit 560574b5
Stable-Candidates: 1.20.x 1.21.x
Reported-by: John Scott <jscott@posteo.net>
(cherry picked from commit 2c4814f7)