<!--- Verify first that your feature was not already discussed on GitHub -->
<!--- Complete *all* sections as described, this form is processed automatically -->

##### SUMMARY
<!--- Describe the new feature/improvement briefly below -->
When installing or updating an already held apt package with the `apt` module, it fails. 
This forces to use the `force: yes` option that it's too broad and already deprecated by apt.

Add an option `allow_change_held_packages` to the `apt` module to use the `--allow-change-held-packages` `apt` option.

##### ISSUE TYPE
- Feature Idea

##### COMPONENT NAME
<!--- Write the short name of the module, plugin, task or feature below, use your best guess if unsure -->
apt

##### ADDITIONAL INFORMATION
<!--- Describe how the feature would be used, why it is needed and what it would solve -->


<!--- Paste example playbooks or commands between quotes below -->
```yaml
- name: Install package with specific version and hold
  block:
    - name: Install {{ package_name }} version {{ version }}"
      apt:
        name: "{{ package_name }}={{ version }}"
        state: present
        (force|allow_change_held_packages): yes

    - name: Hold {{ package_name }} package
      dpkg_selections:
        name: "{{ package_name }}"
        selection: hold
```

This is not idempotent without the `force: yes`, the second run will fail. 
The `allow_change_held_packages` will avoid problems with this special situation.

<!--- HINT: You can also paste gist.github.com links for larger files -->


Related to: https://github.com/ansible/ansible/issues/15394
else:
                    m.fail_json(msg=pkg._failure_string)
            # ad
            # to 
            deps_to_install.extend(pkg.missing_deps)
        except Exception as e:
            m.fail_json(msg="Unable to install package: %s" % to_native(e))
        # an
        pkgs_to_install.append(deb_file)
    # in
    retvals = {}
    if deps_to_install:
        (success, retvals) = install(m=m, pkgspec=deps_to_install, cache=cache,
                                     install_recommends=install_recommends,
                                     fail_on_autoremove=fail_on_autoremove,
                                     allow_unauthenticated=allow_unauthenticated,
                                     allow_downgrade=allow_downgrade,
                                     dpkg_options=expand_dpkg_options(dpkg_options))
        if not success:
            m.fail_json(**retvals)
        changed = retvals.get('changed', False)
    if pkgs_to_install:
        options = ' '.join(["--%s" % x for x in dpkg_options.split(",")])
        if m.check_mode:
            options += " --simulate"
        if force:
            options += " --force-all"
        cmd = "dpkg %s -i %s" % (options, " ".join(pkgs_to_install))
        with PolicyRcD(m):
            rc, out, err = m.run_command(cmd)