Apt provider should now use the mark property. `enusre => held` was deprecated in Puppet 6 and should be removed in Puppet 7