Bug#945283: users should check whether they get same packages as all other users get

[dinar qurbanov <qdinar@gmail.com>]

this problem can be avoided for a user himself if he does this way:
edit /etc/apt/sources.list and put a mirror instead of
http://security.debian.org/debian-security/ .
( for example, http://mirror.yandex.ru/debian-security/ ).
then, after some time, after he runs "apt update", Release file from
mirror becomes downloaded, and he should compare it with the version
from debian's own server. this can be done with command like this,
with appropriate file name, for his mirror:
curl http://security-cdn.debian.org/debian-security/dists/buster/updates/InRelease
| diff /var/lib/apt/lists/mirror.yandex.ru_debian-security_dists_buster_updates_InRelease
-
if there is no difference between files, than it is ok. then he can
run "apt upgrade".