[BUG] salt.states.pkg.installed update_holds=False updates the package

Description
When using the pkg.installed state with update_holds=False, held packages are still updated. According to the documentation, when this flag is false, the package is skipped, and the state will fail.

Setup
I'm using the following state to install nginx on ubuntu 18.04

Nginx package:
  pkg.installed:
    - name: nginx
    - version: 1.18.0*
    - hold: True
    - update_holds: False
    - require:
      - pkgrepo: Nginx package repo

Nginx package repo:
  pkgrepo.managed:
    - humanname: Nginx PPA
    - name: deb https://nginx.org/packages/ubuntu {{ grains.get('oscodename') }} nginx
    - file: /etc/apt/sources.list.d/nginx.list
    - key_url: https://nginx.org/keys/nginx_signing.key

I can confirm the package is held :

# apt-mark showholds nginx
nginx

Steps to Reproduce the behavior
update the version in the state above to 1.20.0*, and apply the state. The state will run successfully and upgrade the package.

Expected behavior
The state should not update the package, and return a failure code.

Versions Report

# salt --versions-report
Salt Version:
          Salt: 3003
 
Dependency Versions:
          cffi: Not Installed
      cherrypy: Not Installed
      dateutil: 2.8.1
     docker-py: Not Installed
         gitdb: 2.0.3
     gitpython: 2.1.8
        Jinja2: 2.10
       libgit2: Not Installed
      M2Crypto: Not Installed
          Mako: Not Installed
       msgpack: 0.5.6
  msgpack-pure: Not Installed
  mysql-python: 1.3.10
     pycparser: Not Installed
      pycrypto: 2.6.1
  pycryptodome: 3.4.7
        pygit2: Not Installed
        Python: 3.6.9 (default, Jan 26 2021, 15:33:00)
  python-gnupg: 0.4.1
        PyYAML: 3.12
         PyZMQ: 17.1.2
         smmap: 2.0.3
       timelib: Not Installed
       Tornado: 4.5.3
           ZMQ: 4.2.5
 
System Versions:
          dist: ubuntu 18.04 bionic
        locale: UTF-8
       machine: x86_64
       release: 4.15.0-147-generic
        system: Linux
       version: Ubuntu 18.04 bionic

Start at Salt's pkg.installed state entry point and trace how update_holds is handled for held packages. Reproduce the issue with the supplied Ubuntu 18.04 nginx state, changing the requested version while nginx is held. Done means the held package is not updated and the state returns a failure code.