to clarify possible concerns people might have when reading this -- even though we're using http which is not encrypted, all the packages are signed & verified using gpg keys, so people wouldn't be able to inject bad packages to containers

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/containers/cros-container-guest-tools/+/55617aa659511c13bb20bed14212b49ee31a5ab5

commit 55617aa659511c13bb20bed14212b49ee31a5ab5
Author: Stephen Barber <smbarber@chromium.org>
Date: Mon Dec 24 12:48:32 2018

lxd: use https repos for Debian

We already install apt-transport-https, so we might as well use HTTPS
consistently. This also requires fixing up the URLs to use the deb.debian.org
redirection service, which correctly handles HTTPS.

BUG= chromium:916655 
TEST=apt-get update works

Change-Id: I0fe4e7bda3e4a7a8317102ff088efadaf4489b7f
Reviewed-on: https://chromium-review.googlesource.com/1384818
Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com>
Tested-by: Stephen Barber <smbarber@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Zach Reizner <zachr@chromium.org>

[modify] https://crrev.com/55617aa659511c13bb20bed14212b49ee31a5ab5/lxd/lxd_setup.sh

Verified on latest container image, we're now using https for all the default repos.