<!--- Verify first that your feature was not already discussed on GitHub -->
<!--- Complete *all* sections as described, this form is processed automatically -->

##### SUMMARY
<!--- Describe the new feature/improvement briefly below -->
When installing or updating an already held apt package with the `apt` module, it fails. 
This forces to use the `force: yes` option that it's too broad and already deprecated by apt.

Add an option `allow_change_held_packages` to the `apt` module to use the `--allow-change-held-packages` `apt` option.

##### ISSUE TYPE
- Feature Idea

##### COMPONENT NAME
<!--- Write the short name of the module, plugin, task or feature below, use your best guess if unsure -->
apt

##### ADDITIONAL INFORMATION
<!--- Describe how the feature would be used, why it is needed and what it would solve -->


<!--- Paste example playbooks or commands between quotes below -->
```yaml
- name: Install package with specific version and hold
  block:
    - name: Install {{ package_name }} version {{ version }}"
      apt:
        name: "{{ package_name }}={{ version }}"
        state: present
        (force|allow_change_held_packages): yes

    - name: Hold {{ package_name }} package
      dpkg_selections:
        name: "{{ package_name }}"
        selection: hold
```

This is not idempotent without the `force: yes`, the second run will fail. 
The `allow_change_held_packages` will avoid problems with this special situation.

<!--- HINT: You can also paste gist.github.com links for larger files -->


Related to: https://github.com/ansible/ansible/issues/15394
default: present
    choices: [ absent, build-dep, latest, present, fixed ]
  update_cache:
    description:
      - Run the equivalent of C(apt-get update) before the operation. Can be run as part of the package installation or as a separate step.
      - Default is not to update the cache.
    aliases: [ update-cache ]
    type: bool
  update_cache_retries:
    description:
      - Amount of retries if the cache update fails. Also see I(update_cache_retry_max_delay).
    type: int
    default: 5
    version_added: '2.10'
  update_cache_retry_max_delay:
    description:
      - Use an exponential backoff delay for each retry (see I(update_cache_retries)) up to this max delay in seconds.
    type: int
    default: 12
    version_added: '2.10'
  cache_valid_time:
    description:
      - Update the apt cache if it is older than the I(cache_valid_time). This option is set in seconds.
      - As of Ansible 2.4, if explicitly set, this sets I(update_cache=yes).
    type: int
    default: 0
  purge:
    description:
     - Will force purging of configuration files if the module state is set to I(absent).
    type: bool