<!--- Verify first that your feature was not already discussed on GitHub -->
<!--- Complete *all* sections as described, this form is processed automatically -->

##### SUMMARY
<!--- Describe the new feature/improvement briefly below -->
When installing or updating an already held apt package with the `apt` module, it fails. 
This forces to use the `force: yes` option that it's too broad and already deprecated by apt.

Add an option `allow_change_held_packages` to the `apt` module to use the `--allow-change-held-packages` `apt` option.

##### ISSUE TYPE
- Feature Idea

##### COMPONENT NAME
<!--- Write the short name of the module, plugin, task or feature below, use your best guess if unsure -->
apt

##### ADDITIONAL INFORMATION
<!--- Describe how the feature would be used, why it is needed and what it would solve -->


<!--- Paste example playbooks or commands between quotes below -->
```yaml
- name: Install package with specific version and hold
  block:
    - name: Install {{ package_name }} version {{ version }}"
      apt:
        name: "{{ package_name }}={{ version }}"
        state: present
        (force|allow_change_held_packages): yes

    - name: Hold {{ package_name }} package
      dpkg_selections:
        name: "{{ package_name }}"
        selection: hold
```

This is not idempotent without the `force: yes`, the second run will fail. 
The `allow_change_held_packages` will avoid problems with this special situation.

<!--- HINT: You can also paste gist.github.com links for larger files -->


Related to: https://github.com/ansible/ansible/issues/15394
- If :// in the path, ansible will attempt to download deb before installing. (Version added 2.1)
       - Requires the C(xz-utils) package to extract the control file of the deb package to install.
     type: path
     required: false
     version_added: "1.6"
  autoremove:
    description:
      - If C(yes), remove unused dependency packages for all module states except I(build-dep). It can also be used as the only option.
      - Previous to version 2.4, autoclean was also an alias for autoremove, now it is its own separate command. See documentation for further information.
    type: bool
    default: 'no'
    version_added: "2.1"
  autoclean:
    description:
      - If C(yes), cleans the local repository of retrieved package files that can no longer be downloaded.
    type: bool
    default: 'no'
    version_added: "2.4"
  policy_rc_d:
    description:
      - Force the exit code of /usr/sbin/policy-rc.d.
      - For example, if I(policy_rc_d=101) the installed package will not trigger a service start.
      - If /usr/sbin/policy-rc.d already exists, it is backed up and restored after the package installation.
      - If C(null), the /usr/sbin/policy-rc.d isn't created/changed.
    type: int
    default: null
    version_added: "2.8"
  only_upgrade:
    description:
      - Only upgrade a package if it is already installed.