security-master: debian-security-debug is not public (yet)

Having it listed as a public archive makes the mirror scripts try to
rsync it to a (nonexisting) public directory which fails.