Fast forward debian/buster to what was previously only in debian/buster-security

This should have no practical effects aswe already ship apertis/2.4.38-3+deb10u3 everywhere as we got it from buster-security, but it syncs our repo status to what Debian ships.

The ci-update-from-upstream pipeline should be taught to do this automatically.