pull-updates: Fix upstream updates from -security branches
Always normalize the upstream release information. This means that when
triggering the pull from the debian/buster-security
branch we behave
exactly like when triggering from debian/buster
.
This fixes pipeline failures where we tried to push
upstream/buster-security
instead of upstream/buster
.
See for instance https://gitlab.apertis.org/pkg/apache-log4j2/-/jobs/1354276 and https://gitlab.apertis.org/pkg/apache-log4j2/-/jobs/1354309.