Actually understand foo,-security (!)

There does not in fact seem to have been any code which implements
this line from dgit(7):
    If a specified subsuite starts with - then mainsuite is prepended.
The code which canonicalises it back to the version with ",-" does
work, though.

Closes:#867189.

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>