deb: resolve pocket suites and serve Debian security updates

A changelog may target a pocket suite ('trixie-security') rather than
the bare series: split the pocket off so the build resolves against
the base series with that pocket enabled - the same target an
explicit '-s trixie -p security' names. The pocket must be one of
the base series' distro-info pockets, which also guards against
series names merely containing a dash; an explicit --pocket wins.

Debian serves security updates from a dedicated archive: appending
the security suite to the main mirror would 404 on 'apt-get update'
(ubuntu serves every pocket from the same archive, where appending
works) - clone the pinned source against deb.debian.org/debian-security
instead, as mmdebstrap does.

src/deb/mod.rs

@@ -319,6 +319,29 @@ async fn build_binary_package_impl(
         log::info!("Suite '{}' resolved to series {}", series, codename);
         series = codename;
     }
+    // A changelog may also target a pocket suite ('trixie-security') rather
+    // than the bare series: split the pocket off so the build resolves
+    // against the base series with that pocket enabled — the same target an
+    // explicit '-s trixie -p security' names. An explicit --pocket wins.
+    // The pocket must be one of the base series' distro-info pockets, which
+    // also guards against series names merely containing a dash.
+    let mut pocket = pocket.clone();
+    if pocket.is_none()
+        && let Some((base, pocket_name)) = series
+            .rsplit_once('-')
+            .map(|(b, p)| (b.to_string(), p.to_string()))
+        && let Ok(dist) = crate::distro_info::get_dist_from_series(&base).await
+        && let Ok(pockets) = crate::distro_info::get_dist_pockets(&dist)
+        && pockets.iter().any(|p| p.as_str() == pocket_name)
+    {
+        pocket = Some(pocket_name.clone());
+        series = base;
+        log::info!(
+            "Pocket suite resolved to series {} (pocket {})",
+            series,
+            pocket_name
+        );
+    }
     let series = series.as_str();
     let current_arch = crate::get_current_arch();
     let arch = arch.as_deref().unwrap_or(&current_arch);