place security mirror after main $apt_mirror to avoid pbuilder failures

Creating a cowbuilder/pbuilder environment fails on systems running
the official Debian AMI. Demonstration:

| # cowbuilder --create --distribution squeeze --debootstrapopts --arch --debootstrapopts amd64 --debootstrapopts --variant=buildd
|  -> Invoking pbuilder
|   forking: pbuilder create --debootstrapopts --arch --debootstrapopts amd64 --debootstrapopts --variant=buildd --buildplace /var/cache/pbuilder/base.cow --mirror http://security.debian.org/ --distribution squeeze --no-targz --extrapackages cowdancer
| [...]
| I: Retrieving Release
| E: Failed getting release file http://security.debian.org/dists/squeeze/Release
| E: debootstrap failed
| W: Aborting with an error
| pbuilder create failed
| [...]

This is caused by pbuilder's magic inside pbuilder's postinst
which sets up a /etc/pbuilderrc using MIRRORSITE. MIRRORSITE
itself is calculated by the content of /etc/apt/sources.list.
Demonstration by using pbuilder's postinst code:

| # MIRRORSITE=$(
|   ( [ -f /etc/apt/sources.list ] && cat /etc/apt/sources.list || true ;
|     [ -f $SRCLISTDIR/*.sources.list ] && cat $SRCLISTDIR/*.sources.list || true ) \
|   | grep -E '^deb[[:space:]]+(ftp|http):' | head -n 1 | awk '{print $2;}'
|   )
| # echo $MIRRORSITE
| http://security.debian.org/
| # grep -v '^#' /etc/pbuilderrc
| MIRRORSITE=http://security.debian.org/

By switching the order of the mirrors in /etc/apt/sources.list
this pbuilder/cowbuilder issue with MIRRORSITE can be avoided.