<!--- Verify first that your feature was not already discussed on GitHub -->
<!--- Complete *all* sections as described, this form is processed automatically -->

##### SUMMARY
<!--- Describe the new feature/improvement briefly below -->
When installing or updating an already held apt package with the `apt` module, it fails. 
This forces to use the `force: yes` option that it's too broad and already deprecated by apt.

Add an option `allow_change_held_packages` to the `apt` module to use the `--allow-change-held-packages` `apt` option.

##### ISSUE TYPE
- Feature Idea

##### COMPONENT NAME
<!--- Write the short name of the module, plugin, task or feature below, use your best guess if unsure -->
apt

##### ADDITIONAL INFORMATION
<!--- Describe how the feature would be used, why it is needed and what it would solve -->


<!--- Paste example playbooks or commands between quotes below -->
```yaml
- name: Install package with specific version and hold
  block:
    - name: Install {{ package_name }} version {{ version }}"
      apt:
        name: "{{ package_name }}={{ version }}"
        state: present
        (force|allow_change_held_packages): yes

    - name: Hold {{ package_name }} package
      dpkg_selections:
        name: "{{ package_name }}"
        selection: hold
```

This is not idempotent without the `force: yes`, the second run will fail. 
The `allow_change_held_packages` will avoid problems with this special situation.

<!--- HINT: You can also paste gist.github.com links for larger files -->


Related to: https://github.com/ansible/ansible/issues/15394
attributes:
    check_mode:
        support: full
    diff_mode:
        support: full
    platform:
        platforms: debian
notes:
   - Three of the upgrade modes (C(full), C(safe) and its alias C(yes)) required C(aptitude) up to 2.3, since 2.4 C(apt-get) is used as a fall-back.
   - In most cases, packages installed with apt will start newly installed services by default. Most distributions have mechanisms to avoid this.
     For example when installing Postgresql-9.5 in Debian 9, creating an excutable shell script (/usr/sbin/policy-rc.d) that throws
     a return code of 101 will stop Postgresql 9.5 starting up after install. Remove the file or remove its execute permission afterwards.
   - The apt-get commandline supports implicit regex matches here but we do not because it can let typos through easier
     (If you typo C(foo) as C(fo) apt-get would install packages that have "fo" in their name with a warning and a prompt for the user.
     Since we don't have warnings and prompts before installing we disallow this.Use an explicit fnmatch pattern if you want wildcarding)
   - When used with a `loop:` each package will be processed individually, it is much more efficient to pass the list directly to the `name` option.
'''
EXAMPLES = '''
- name: Install apache httpd  (state=present is optional)
  apt:
    name: apache2
    state: present
- name: Update repositories cache and install "foo" package
  apt:
    name: foo
    update_cache: yes
- name: Remove "foo" package
  apt:
    name: foo
    state: absent