More minor debian-security mirror fixes

As a follow-on to Ic33bca431ae19b44e5bc2938de425cc68785b331
... (reprepro configuration really is quite inscrutable outside "try
it and see if it works")

The update is just called "debian-security", no codename.

We want to use the debian-security key to validate the gpg signatures,
update that.

Use the "updates" suite, which seems to be where debian-security is

Add the symlink for mirror

Change-Id: Ice2a06f4274cdad766f427df70d9fe3e92f62e8c

modules/openstack_project/files/reprepro/debian-security-updates

@@ -1,8 +1,6 @@
 Name: debian-security
 Method: http://security.debian.org/
-Suite: stretch/updates
-Components: main
-UDebComponents: main
+Suite: */updates
 Architectures: amd64 arm64
 GetInRelease: no
-VerifyRelease: 8AE22BA9
+VerifyRelease: C857C906

modules/openstack_project/manifests/mirror.pp

@@ -87,6 +87,17 @@ class openstack_project::mirror (
     ]
   }
 
+  # Create the symlink to debian-security
+  file { "${www_root}/debian-security":
+    ensure  => link,
+    target  => "${mirror_root}/debian-security",
+    owner   => root,
+    group   => root,
+    require => [
+      File["${www_root}"],
+    ]
+  }
+
   # Create the symlink to Debian OpenStack Packaging Team reprepro.
   file { "${www_root}/debian-openstack":
     ensure  => link,

modules/openstack_project/templates/reprepro/distributions.debian-security.erb

@@ -1,13 +1,14 @@
 <% @releases.each do |release| -%>
 
 Origin: Debian Security
-Codename: <%= release %>-security
+Codename: <%= release %>
+Suite: updates
 Description: OpenStack Debian Security <%= release.capitalize %> mirror
 Architectures: amd64 arm64 source
 Components: main
 UDebComponents: main
 Contents: .gz
-Update: debian-<%= release %>-security
+Update: debian-security
 Log: <%= @logdir %>/debian-security-<%= release %>.log
 
 <% end -%>