pkg-pull-updates: Fix package name quoting

When querying madison, the package name needs to be quoted or special characters may cause issues. For instance, the + in the gtk+3.0 package needs to be escaped, or madison returns no matches:

$ curl 'https://qa.debian.org/madison.php?package=gtk+3.0&yaml=on&s=jessie'
--- {}
$ curl 'https://qa.debian.org/madison.php?package=gtk%2B3.0&yaml=on&s=jessie'
---
gtk+3.0:
  3.14.5-1+deb8u1:
    jessie:
      - source