unattended-upgrades regex should block all kernels except grsec

grsec patches are periodically upgraded for LTS releases of the Linux
kernel, while the kernel itself is upgraded more frequently by default
in Ubuntu. We want to allow the installation and auto-upgrade of the
grsec kernel that we provide, but do not want unattended-upgrades to
clobber our grsec kernel with a newer (but not grsec-hardened) version
of the Linux kernel provided by the default repos.

This regular expression matches (therefore blacklists) any package name
that begins with "linux-(image|headers)" unless the string "grsec"
appears later in the string.