Hold the docker-ce-cli (#6995)

This will make sure an upgrade doesn't upgrade the docker cli.

roles/container-engine/docker/tasks/main.yml

@@ -207,9 +207,12 @@
 # This is required to ensure any apt upgrade will not break kubernetes
 - name: Tell Debian hosts not to change the docker version with apt upgrade
   dpkg_selections:
-    name: docker-ce
+    name: "{{ item }}"
     selection: hold
   when: ansible_os_family in ["Debian"]
+  with_items:
+    - docker-ce
+    - docker-ce-cli
 
 - name: Ensure latest version of libseccomp installed  # noqa 403
   package: