Comment 9 for bug 1963751

The other option in u-a might be to split Unattended-Upgrade::Allowed-Origins into "Automatic origins" and "permitted origins", so only packages in the former will be automatically installed, but upgraded dependencies could be pulled from the latter if required?