import_debian: Do not use Debian branch names as versions

Where a fix is pending on a Debian branch name but without any patch identified, we don't know the actual version it will be released as or what the fix is. Currently import_debian can produce a reference like 'version:stretch-security'. This was not intended and is not a useful reference. Only use the 'version:' scheme for released fixes.