APT preferring `stable` over `stable-security`

[Stefan Monnier <monnier@iro.umontreal.ca>]

I noticed today that one of my machines was still running openssh
1:9.2p1-2+deb12u1 rather than  1:9.2p1-2+deb12u2 even though it is
supposed to do its unattended-upgrades, so I tried a manual upgrade and
the result was still the same.

Only after

    apt install openssh-server/stable-security

did the machine get the new version :-(

The `sources.list` files says:

    deb http://security.debian.org/ stable-security main
    deb http://deb.debian.org/debian stable main

and the `apt.conf` says:

    APT::Default-Release "stable";
    Aptitude::CmdLine::Show-Deps "true";
    APT::Periodic::Unattended-Upgrade "1";

Which I thought was the "normal" config (modulo the use of "stable"
instead of "bookworm") where the `stable-security` would automatically
take precedence when applicable.  But it looks like the
`stable-security` repository is just not used at all!

What am I missing?


        Stefan