Use testing, not unstable

We need something more recent than stable, because otherwise debootstrap
will not (yet) know about the recent ubuntu releases.

However, unstable is sometimes uninstallable when major subsystems are
updated, which can make things more complicated if we try to update the
image at the wrong time.

Work around this by using testing rather than unstable

.ci/dockerfiles/deb-sbuild/Dockerfile

@@ -3,7 +3,7 @@
 # distribution and a few things changed so we get a more recent version of
 # debootstrap.
 
-FROM debian:unstable-slim
+FROM debian:testing-slim
 
 RUN echo "deb http://deb.debian.org/debian experimental main" >> /etc/apt/sources.list