roles/package: tolerate errors while updating apt cache

If for example a repository key is expired, this should not
block the whole processing, except when the package state is
"latest".

To achieve this, before installing package, we always try to
update apt cache in a separate step for which we tolerate
errors and in a second step we only install the package without
updating cache - unless the package state is latest.

The idea is when we want to install the latest package, it's a
problem if we can't update cache before, but when we just want
the package to be present, errors during apt update should are
not a problem.

Only debian was adjusted with this logic.

playbook/roles/package/tasks/main.yml

-  - name: Install {{ package_name }} using apt
-    apt: name={{ package_name }} state={{ package_state }} update_cache=yes cache_valid_time=3600
+  - name: Try to update apt cache
+    apt: update_cache=yes cache_valid_time=3600
     when: ansible_os_family == "Debian" or ansible_os_family == "Linuxmint" or ansible_os_family == "Kylin"
+    ignore_errors: true
+
+  - name: Install {{ package_name }} (latest) using apt
+    # We use update_cache=yes without ignoring errors (Unlike the "Try to update apt cache" task above),
+    # because if `latest` package is requested it is an error if we can not update the cache.
+    apt: name={{ package_name }} state={{ package_state }} update_cache=yes cache_valid_time=3600
+    when: package_state == "latest" and ansible_os_family == "Debian" or ansible_os_family == "Linuxmint" or ansible_os_family == "Kylin"
+
+  - name: Install {{ package_name }} using apt
+    apt: name={{ package_name }} state={{ package_state }}
+    when: package_state != "latest" and ansible_os_family == "Debian" or ansible_os_family == "Linuxmint" or ansible_os_family == "Kylin"
 
   - name: Install {{ package_name }} using yum
     yum: name={{ package_name }} state={{ package_state }} update_cache=yes