exclude nginx from updates with apt-mark hold