How to locate an URL that serves public GPG key for a package repository?

You are trying to install a package from ubuntu repository on debian, but Debian doesn't have ubuntu keys. Adding a new repository require a trusted gpg key allowing the packages to be authenticated.

Only 3rd part repository require a new gpg key, or in case of a key replacement.

add-apt-repository will add a new repository and add the gpg key.

man add-apt-repository:

  In  the second form, ppa:<user>/<ppa-name> will be expanded to the full
   deb  line  of  the  PPA  and   added   into   a   new   file   in   the
   /etc/apt/sources.list.d/  directory.   The  GPG public key of the newly
   added PPA will also be downloaded and added to apt's keyring.

On debian jessie you don't need to add Ubuntu repository, it is available through the security repository.

Remove the trusty repoitory , then add the following line to your /etc/apt/sources.list:

deb http://security.debian.org/debian-security jessie/updates main 

then run:

sudo apt update
sudo apt install mysql-server-5.5

Debian: secure apt

In this case, you do indeed have a stable answer. It's referenced in the "official" documentation (https://help.ubuntu.com/community/VerifyIsoHowto#Get_the_key)

In your case you are referencing a "trusted" (by you) keyserver (keyserver.ubuntu.com) and requesting keys by the specific IDs (40976EAF437D05B5 & 3B4FE6ACC0B21F32). Retrieving the keys in this manner allows for the administrators of the Ubuntu infrastructure to handle updates without your intervention. Using the key IDs is actually referencing a cryptographic hash of the key itself.

The only possible improvement I would make is using the "full" key ID which allows for an even more precise retrieval and would necessitate an even more committed attacker.

It should be noted though that the gpg version of the command in the documentation above is for adding the same key to your user keyring so that you can use the key for verification. The apt-key command is adding the key to the apt keyring so that the system can use the key for verification.

As to the sub-questions:

Do all package repositories that require keys have an URL that serves public GPG keys? and Is there any format for such URL?

No. Not all repositories (deb/apt, rpm/yum/dnf) post their keys via a specific "well known" URL. As many of the mechanisms for key retrieval are built into the respective package management system it's left up to that tooling. The one note there is that in the case of RPM based systems, Yum and DNF specify metadata in the repository definition to make it easier for the administrator, but is is not a requirement for use nor is the URI path standardized.

As an aside the process for doing this may get ratified in the future as RFC 5785 and RFC 8615 are now "a thing" but would be a future improvement.