Fix NPE when serializing roles.xml and add nullability annotations.

This change fixes the NPE when serializing roles.xml if package hash
is null, and added the missing nullability annotations in role manager
service to make things clear and let the IDE warn.

Bug: 110557011
Test: manual
Change-Id: I27b5942ff6091414c527d7d337d7d01218e88fb0