Three times we need mirrors:

Once for debootstrap. Only one, primary mirror.

Once for rest of the install. Each of primary, -updates, and -security.

Once for the final system. Each of primary, -updates, and -security.

Does not need to be accessible from the building system.

Variables:
mirror
security-mirror
install-mirror
install-security-mirror
(default mirror)
(default security mirror)

Fallbacks:
install-mirror  -> mirror -> default mirror
install-security-mirror  -> security-mirror -> default security-mirror


