Security fixes

• Upgrade tor to 0.3.0.9-1~d90.stretch+1 (Closes: #13253).

• Upgrade Linux to 4.9.30-2+deb9u2.

• Upgrade libc to 2.24-11+deb9u1.

• Upgrade libexpat1 to 2.2.0-2+deb9u1.

• Upgrade libgcrypt20 to 1.7.6-2+deb9u1.

• Upgrade libgnutls30 to 3.5.8-5+deb9u1.

• Enable Debian security APT sources (Closes: #12309).

• Minor improvements

• Use a higher resolution image in Zero Trace Pen persistence setup
  (Closes: #12510).

• Bugfixes

• Forcibly set $SSH_AUTH_SOCK before starting GNOME
  Shell. Apparently, due to a race condition, GNOME keyring
  sometimes fails to tell the session manager about the correct
  SSH_AUTH_SOCK, and thus GNOME Terminal hasn't this variable set
  and any ssh process started in there won't use the (perfectly
  working) SSH agent (Closes: #12481).

• Fix issue that made Zero Trace Pen Installer rejects working USB drives,
  pretending they're not "removable" (Closes: #12696).

• Make behavior of the power button and lid close actions in the Greeter
  consistent with the regular GNOME session (Closes: #13000).

• Build system

• Track the latest debian-security archive for the corresponding
  APT sources, and not for the unrelated jessie-updates (Closes:

  12829).

• Print APT sources used in the build VM, to help debugging issues
  such as #12829.