[FEATURE REQUEST] Pin apt packages after installation

[mmiller1]

In order to allow safe patching of debian systems in between upgrades, Kubernetes apt packages should be pinned at their current version after installation, and unpinned prior to an upgrade. If this is done, one could simply run apt-get dist-upgrade to pull in the latest security patches without accidentally upgrading Kubernetes components.