Use new security.debian.org repository layout for bullseye and newer

Quoting from https://lists.debian.org/debian-devel-announce/2019/07/msg00004.html:

| over the last years we had people getting confused over <suite>-updates
| (recommended updates) and <suite>/updates (security updates).  Starting
| with Debian 11 "bullseye" we have therefore renamed the suite including
| the security updates to <suite>-security.
|
| An entry in sources.list should look like
|
|   deb http://security.debian.org/debian-security bullseye-security main
|
| For previous releases the name will not change.