<!--- Verify first that your feature was not already discussed on GitHub -->
<!--- Complete *all* sections as described, this form is processed automatically -->

##### SUMMARY
<!--- Describe the new feature/improvement briefly below -->
When installing or updating an already held apt package with the `apt` module, it fails. 
This forces to use the `force: yes` option that it's too broad and already deprecated by apt.

Add an option `allow_change_held_packages` to the `apt` module to use the `--allow-change-held-packages` `apt` option.

##### ISSUE TYPE
- Feature Idea

##### COMPONENT NAME
<!--- Write the short name of the module, plugin, task or feature below, use your best guess if unsure -->
apt

##### ADDITIONAL INFORMATION
<!--- Describe how the feature would be used, why it is needed and what it would solve -->


<!--- Paste example playbooks or commands between quotes below -->
```yaml
- name: Install package with specific version and hold
  block:
    - name: Install {{ package_name }} version {{ version }}"
      apt:
        name: "{{ package_name }}={{ version }}"
        state: present
        (force|allow_change_held_packages): yes

    - name: Hold {{ package_name }} package
      dpkg_selections:
        name: "{{ package_name }}"
        selection: hold
```

This is not idempotent without the `force: yes`, the second run will fail. 
The `allow_change_held_packages` will avoid problems with this special situation.

<!--- HINT: You can also paste gist.github.com links for larger files -->


Related to: https://github.com/ansible/ansible/issues/15394
if use_apt_get:
            apt_cmd = APT_GET_CMD
        else:
            m.fail_json(msg="Unable to find APTITUDE in path. Please make sure "
                            "to have APTITUDE in path or use 'force_apt_get=True'")
    apt_cmd_path = m.get_bin_path(apt_cmd, required=True)
    cmd = '%s -y %s %s %s %s %s %s %s' % (
        apt_cmd_path,
        dpkg_options,
        force_yes,
        fail_on_autoremove,
        allow_unauthenticated,
        allow_downgrade,
        check_arg,
        upgrade_command,
    )
    if default_release:
        cmd += " -t '%s'" % (default_release,)
    with PolicyRcD(m):
        rc, out, err = m.run_command(cmd, prompt_regex=prompt_regex)
    if m._diff:
        diff = parse_diff(out)
    else:
        diff = {}
    if rc:
        m.fail_json(msg="'%s %s' failed: %s" % (apt_cmd, upgrade_command, err), stdout=out, rc=rc)
    if (apt_cmd == APT_GET_CMD and APT_GET_ZERO in out) or (apt_cmd == APTITUDE_CMD and APTITUDE_ZERO in out):
        m.exit_json(changed=False, msg=out, stdout=out, stderr=err)
    m.exit_json(changed=True, msg=out, stdout=out, stderr=err, diff=diff)
def get_cache_mtime():