flip around security support for debian

with the release of squeeze-lts, the current way we deal with security
sources is problemaic. by flipping things around we hope to make the
files contents more stable.
make it optional to end sources in ".list"
Merge branch 'flip_security_source' into 'master'

Flip security source

Implement bug #8334

the diff in the redmine issue has two checks for codenames, but I'm wondering if they're adding anything to the "releases" check.

See merge request !1
Merge branch 'append_list' into 'master'

Append list

I've implemented #6200 in a backwards-compatible manner: this change makes ending sources in ".list" optional

See merge request !2