pull-updates: Fix upstream updates from -security branches

Always normalize the upstream release information. This means that when triggering the pull from the debian/buster-security branch we behave exactly like when triggering from debian/buster.

This fixes pipeline failures where we tried to push upstream/buster-security instead of upstream/buster.

See for instance https://gitlab.apertis.org/pkg/apache-log4j2/-/jobs/1354276 and https://gitlab.apertis.org/pkg/apache-log4j2/-/jobs/1354309.