It breaks stuff with out APT snapshots, since our debian-security mirror
has "Codename: jessie/updates". To fix that, we would need to duplicate
all these sections. Let's not bother and rely on the default pinning for
Jessie and jessie/updates, that will do the right thing.