do not use mirrors for security repositories

Security updates should always be fetched directly from the security servers.