Use "codename-security" suite on security mirror

https://lists.debian.org/debian-devel-announce/2019/07/msg00004.html

Of course, happy to rebase, amend, adjust, etc. 😄 ❤ 👍

(I wasn't sure whether this was the right change given it's going into unstable/testing and shouldn't hit stable, or whether it needs to somehow be conditional based on whether we're generating for bullseye+ somehow, so I figured I'd open with the easy change to start the conversation. 😅)