### Summary

When running the yum module with state: present or state: installed, certain packages will be upgraded even though they should be skipped with that parameter.

### Issue Type

Bug Report

### Component Name

yum.py

### Ansible Version

```console
$ ansible --version
ansible 2.9.23
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3.6/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 3.6.8 (default, Aug 18 2020, 08:33:21) [GCC 8.3.1 20191121 (Red Hat 8.3.1-5)]
```


### Configuration

```console
$ ansible-config dump --only-changed
```


### OS / Environment

RHEL 8

### Steps to Reproduce

Using gtk2 as example package

1. verify package is not at latest version:
```
[root@node-1 tmp]# rpm -qa | grep gtk
gtk2-2.24.32-4.el8.i686
```
2. run playbook below 
3. verify package version:
```
[root@node-1 tmp]# rpm -qa | grep gtk
gtk2-2.24.32-5.el8.i686
```
```
---

- name: Test yum module
  hosts: localhost
  gather_facts: yes
  become: true

  tasks:
    - name: Install packages
      yum:
        name: "{{ packages }}"
        state: installed
      vars:
        packages:
        - gtk2.i686
~                        
```


### Expected Results

With state: present or installed, it is expected that packages with available updates do not get updated. 

### Actual Results

```console
TASK [Install packages] ********************************************************************************
task path: /tmp/yum.yml:9
<127.0.0.1> ESTABLISH LOCAL CONNECTION FOR USER: root
<127.0.0.1> EXEC /bin/sh -c 'echo ~root && sleep 0'
<127.0.0.1> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /root/.ansible/tmp `"&& mkdir "` echo /root/.ansible/tmp/ansible-tmp-1627050288.7489398-29887-63179730413665 `" && echo ansible-tmp-1627050288.7489398-29887-63179730413665="` echo /root/.ansible/tmp/ansible-tmp-1627050288.7489398-29887-63179730413665 `" ) && sleep 0'
Using module file /usr/lib/python3.6/site-packages/ansible/modules/packaging/os/dnf.py
<127.0.0.1> PUT /root/.ansible/tmp/ansible-local-29831fpwi4rpz/tmpbhndnpc6 TO /root/.ansible/tmp/ansible-tmp-1627050288.7489398-29887-63179730413665/AnsiballZ_dnf.py
<127.0.0.1> EXEC /bin/sh -c 'chmod u+x /root/.ansible/tmp/ansible-tmp-1627050288.7489398-29887-63179730413665/ /root/.ansible/tmp/ansible-tmp-1627050288.7489398-29887-63179730413665/AnsiballZ_dnf.py && sleep 0'
<127.0.0.1> EXEC /bin/sh -c '/usr/bin/python3.6 /root/.ansible/tmp/ansible-tmp-1627050288.7489398-29887-63179730413665/AnsiballZ_dnf.py && sleep 0'
<127.0.0.1> EXEC /bin/sh -c 'rm -f -r /root/.ansible/tmp/ansible-tmp-1627050288.7489398-29887-63179730413665/ > /dev/null 2>&1 && sleep 0'
changed: [localhost] => {
    "changed": true,
    "invocation": {
        "module_args": {
            "allow_downgrade": false,
            "autoremove": false,
            "bugfix": false,
            "conf_file": null,
            "disable_excludes": null,
            "disable_gpg_check": false,
            "disable_plugin": [],
            "disablerepo": [],
            "download_dir": null,
            "download_only": false,
            "enable_plugin": [],
            "enablerepo": [],
            "exclude": [],
            "install_repoquery": true,
            "install_weak_deps": true,
            "installroot": "/",
            "list": null,
            "lock_timeout": 30,
            "name": [
                "gtk2.i686"
            ],
            "releasever": null,
            "security": false,
            "skip_broken": false,
            "state": "present",
            "update_cache": false,
            "update_only": false,
            "validate_certs": true
        }
    },
    "msg": "",
    "rc": 0,
    "results": [
        "Installed: gtk2-2.24.32-5.el8.i686",
        "Removed: gtk2-2.24.32-4.el8.i686"
    ]
}
```


### Code of Conduct

- [x] I agree to follow the Ansible Code of Conduct
- Disable the excludes defined in DNF config files.
      - If set to C(all), disables all excludes.
      - If set to C(main), disable excludes defined in [main] in dnf.conf.
      - If set to C(repoid), disable excludes defined for given repo id.
    version_added: "2.7"
    type: str
  validate_certs:
    description:
      - This only applies if using a https url as the source of the rpm. e.g. for localinstall. If set to C(no), the SSL certificates will not be validated.
      - This should only set to C(no) used on personally controlled sites using self-signed certificates as it avoids verifying the source site.
    type: bool
    default: "yes"
    version_added: "2.7"
  allow_downgrade:
    description:
      - Specify if the named package and version is allowed to downgrade
        a maybe already installed higher version of that package.
        Note that setting allow_downgrade=True can make this module
        behave in a non-idempotent way. The task could end up with a set
        of packages that does not match the complete list of specified
        packages to install (because dependencies between the downgraded
        package and others can cause changes to the packages which were
        in the earlier transaction).
    type: bool
    default: "no"
    version_added: "2.7"
  install_repoquery:
    description:
      - This is effectively a no-op in DNF as it is not needed with DNF, but is an accepted parameter for feature
        parity/compatibility with the I(yum) module.