Prefer TOP_UPSTREAM_SOURCE_PROJECT if available and add security sources
This is needed for https://gitlab.com/gitlab-org/security/gitlab/-/issues/67 otherwise it's not pulling from the security project.
- Testing merge request: https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/605
- Actual merge request: gitlab!33890 (merged)
- Triggered pipeline from the testing merge request: https://gitlab.com/gitlab-org/build/omnibus-gitlab-mirror/-/pipelines/153002321
This should be backward compatible, so we should be able to merge this first.
Edited by 🤖 GitLab Bot 🤖