##### SUMMARY
When doing a harmless apt install for a package, this might uninstall other packages and break stuff heavy, especially if there are lots of pending upgrades.

##### ISSUE TYPE
- Bug Report

##### COMPONENT NAME
apt

##### ANSIBLE VERSION
```
ansible 2.8.2
  config file = /home/alexg/mw-config/ansible.cfg
  configured module search path = [u'/home/alexg/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /home/alexg/.local/lib/python2.7/site-packages/ansible
  executable location = /home/alexg/.local/bin/ansible
  python version = 2.7.15+ (default, Jul  9 2019, 16:51:35) [GCC 7.4.0]
```

##### CONFIGURATION
```
DEFAULT_CALLBACK_PLUGIN_PATH(/home/alexg/mw-config/ansible.cfg) = [u'/home/alexg/mw-config/ansible/plugins/callback']
DEFAULT_CALLBACK_WHITELIST(/home/alexg/mw-config/ansible.cfg) = [u'zabbix']
DEFAULT_HOST_LIST(/home/alexg/mw-config/ansible.cfg) = [u'/home/alexg/mw-config/inventory']
DEFAULT_ROLES_PATH(/home/alexg/mw-config/ansible.cfg) = [u'/home/alexg/mw-config/roles']
DEFAULT_STDOUT_CALLBACK(/home/alexg/mw-config/ansible.cfg) = nice_failures
```

##### OS / ENVIRONMENT
target server was a debian machine, pending an upgrade stretch->buster

##### STEPS TO REPRODUCE
Just running something like
```yaml
  - name: "Install some packages"
    apt:
      name: vim
      state: present
      update_cache: yes
```
can make the underlying apt uninstall some packages, depending on the current apt status. In this case installation of 4 basic packages on the machine with 600+ packages pending upgrade caused apt to uninstalled the VM hypervisor...

##### EXPECTED RESULTS
Need more control on dependency handling:
default should be to install package + requirements, but never uninstall other packages. That should get a separate option.
Alternative would be to fail when there is a uninstall going to happen, or just fail when there are pending upgrades at all.

##### ACTUAL RESULTS
Uninstalled libvirtd, shtudown of 5 VMs...Can't reproduce right now, because had to rush to fix it.
I guess this is obvious behaviour when you run apt install -y $package.
default_release:
    description:
      - Corresponds to the C(-t) option for I(apt) and sets pin priorities
  install_recommends:
    description:
      - Corresponds to the C(--no-install-recommends) option for I(apt). C(yes) installs recommended packages.  C(no) does not install
        recommended packages. By default, Ansible will use the same defaults as the operating system. Suggested packages are never installed.
    aliases: ['install-recommends']
    type: bool
  force:
    description:
      - 'Corresponds to the C(--force-yes) to I(apt-get) and implies C(allow_unauthenticated: yes)'
      - "This option will disable checking both the packages' signatures and the certificates of the
        web servers they are downloaded from."
      - 'This option *is not* the equivalent of passing the C(-f) flag to I(apt-get) on the command line'
      - '**This is a destructive operation with the potential to destroy your system, and it should almost never be used.**
         Please also see C(man apt-get) for more information.'
    type: bool
    default: 'no'
  allow_unauthenticated:
    description:
      - Ignore if packages cannot be authenticated. This is useful for bootstrapping environments that manage their own apt-key setup.
      - 'C(allow_unauthenticated) is only supported with state: I(install)/I(present)'
    type: bool
    default: 'no'
    version_added: "2.1"
  upgrade:
    description:
      - If yes or safe, performs an aptitude safe-upgrade.
      - If full, performs an ap.