config/debian-security: use `suite.last_changed` to detect changes

All `Packages.xz` indices are regenerated if an upload to any suite
happened.  The old code thus reported every suite as changed to
wanna-build.