If the image being built is jessie or stretch, add security apt sources.

I considered moving to using 'stable', 'testing' all over the place
instead of the code-names, but this would have the undesired effect
of changing releases automatically when the code names roll over.

I looked for a way of mapping testing->stretch etc in a more future
proof fashion but came up short. /etc/debian_version is not useful
for this.

Closes: #9, #10.