repos: change security repo link for future proofing and add note for bullseye
Actual this is a no-change change, as they URLs both resolve to the
exact same folders (are symlinked), i.e., see:
http://security-cdn.debian.org/dists/
vs.
http://security-cdn.debian.org/debian-security/dists/
but just change it nonetheless to match Debian's recommendation.
Also, add a FIXME not for the future 7.0 as there we need to change
the security suite name too[0].