pull: search pockets in release order by default

Without an explicit --pocket, find_package stops at the first pocket
containing the package, but the search order listed '-proposed' first
and never included '-security': unreleased proposed packages won by
default and security-only updates were unreachable. Search the main
archive first, then updates, security, and proposed last.

distro_info.yml

@@ -12,8 +12,9 @@ dist:
     base_url: https://deb.debian.org/debian
     archive_keyring: https://ftp-master.debian.org/keys/archive-key-{series_num}.asc
     pockets:
-      - proposed-updates
       - updates
+      - security
+      - proposed-updates
     series:
       local: /usr/share/distro-info/debian.csv
       network: https://salsa.debian.org/debian/distro-info-data/-/raw/main/debian.csv
@@ -21,8 +22,9 @@ dist:
     base_url: https://archive.ubuntu.com/ubuntu
     archive_keyring: https://archive.ubuntu.com/ubuntu/project/ubuntu-archive-keyring.gpg
     pockets:
-      - proposed
       - updates
+      - security
+      - proposed
     series:
       local: /usr/share/distro-info/ubuntu.csv
       network: https://salsa.debian.org/debian/distro-info-data/-/raw/main/ubuntu.csv