Sources list setup for security: switch from testing/updates to testing-security

Supposed to fix:

| E: Failed to fetch http://security.debian.org/dists/testing/updates/main/source/Sources  404  Not Found [IP: 2a04:4e42:9::204 80]

Nowadays only http://security-cdn.debian.org/dists/testing-security/ exists.
Quoting from https://lists.debian.org/debian-security/2019/06/msg00015.html:

| I would like to switch to *-security instead of */updates starting with
| bullseye.  There will likely be some complications, but they should be
| solvable by the time we will publish packages in bullseye-security.