STILL INCOMPLETE LISTING.

Most packages are straight backports from unstable (now), eventually ensuring
that SElinux support is correctly detected (Debian has non-Linux kernels, too!)

Noteable exceptions:
libc:
- don't use executeable memory maps for threads
shadow:
- enable SELinux in pam.d/login by default.
- downgrade debianutils dependency to allow backport
openssh:
- downgrade libssl dependency
- disable zlib version check, stable security is okay
- enable SELinux in pam.d/ssh by default.