debian-specific: minor updates to security-NEW

The commands missed stripping the ".changes" extension for the notes
in COMMENTS.  Also files might have gotten renamed if there were
previous uploads that were rejected.