Hey, thanks for sharing all the details and welcome to the Streamlit community! 
The error E: Release file for http://deb.debian.org/debian-security/dists/bullseye-security/InRelease is expired (invalid since 7h+) is an infrastructure-level issue with the Debian package repository used by Streamlit Community Cloud. This isn’t caused by your app or packages.txt, but rather by the upstream Debian security repo’s metadata expiring, which prevents apt from installing dependencies during deployment.
This type of issue has occurred before and is resolved on the Streamlit side when the base image or repository metadata is refreshed. There’s no action needed on your end except to wait for the Streamlit team or Debian maintainers to update the repository. For more info, see similar reports and resolutions in the forum: Deployment error: package.txt, Debian repo bullseye-security changed its codename, and App dependencies for your Community Cloud app.
Sources: