Replace security.ubuntu.com when setting mirror

The current method to rewrite the mirror URL in the ubuntu element will
only rewrite archive.ubuntu.com, which leaves the security URL alone.
This is probably not intended for people who are creating images behind
firewalls.

Change-Id: I54a867e0e9d5a7c94324a5c00ff1a83b4e6e4524