Ansible role to selectively upgrade packages on Debian