Let APT install the newest systemd among those available in stretch-backports...

Let APT install the newest systemd among those available in stretch-backports and in our custom APT repo (refs: #16352, #16184)

This ensures our custom backport (240-4~bpo9+0tails1) is superseded
by the official one once the latter is uploaded.

config/chroot_apt/preferences

@@ -85,6 +85,12 @@ Pin-Priority: 990
 Explanation: src:systemd
 Explanation: systemd >= v233 required for meek_lite and enable the unsafe browser and Tor launcher applications to do clearnet DNS resolution. (#8243)
 Package: systemd systemd-sysv systemd-container systemd-journal-remote systemd-coredump systemd-tests libpam-systemd libnss-myhostname libnss-mymachines libnss-resolve libnss-systemd libsystemd0 libsystemd-dev udev libudev1 libudev-dev udev-udeb libudev1-udeb
+Pin: release o=Debian,n=stretch-backports
+Pin-Priority: 999
+
+Explanation: src:systemd
+Explanation: systemd >= v240 required to fix CVE-2018-16864, CVE-2018-16865 and CVE-2018-16866 (#16352)
+Package: systemd systemd-sysv systemd-container systemd-journal-remote systemd-coredump systemd-tests libpam-systemd libnss-myhostname libnss-mymachines libnss-resolve libnss-systemd libsystemd0 libsystemd-dev udev libudev1 libudev-dev udev-udeb libudev1-udeb
 Pin: origin deb.tails.boum.org
 Pin-Priority: 999