Properly handle custom unattended_origins_patterns variable

Well, this is painful.

defaults/main.yml

@@ -2,7 +2,12 @@
 #Unattended-Upgrade::Origins-Pattern
 # Automatically upgrade packages from these origin patterns
 # e.g.: 'o=Debian,a=stable', 'o=Debian,a=stable-updates'
-unattended_origins_patterns: []
+#
+# Left unset, distribution-specific defaults will be used through
+# __unattended_origins_patterns variable only if this variable
+#   is not provided externally
+# REFS https://github.com/ansible/ansible/issues/8121
+#unattended_origins_patterns: []
 
 #Unattended-Upgrade::Package-Blacklist
 # List of packages to not update

templates/unattended-upgrades.j2

@@ -1,9 +1,15 @@
 // Unattended-Upgrade::Origins-Pattern controls which packages are
 // upgraded.
 Unattended-Upgrade::Origins-Pattern {
-{% for origin in unattended_origins_patterns %}
-        "{{ origin }}";
-{% endfor %}
+{% if unattended_origins_patterns is defined %}
+  {% for origin in unattended_origins_patterns %}
+    "{{ origin }}";
+  {% endfor %}
+{% else %}
+  {% for origin in __unattended_origins_patterns %}
+   "{{ origin }}";
+  {% endfor %}
+{% endif %}
 };
 
 // List of packages to not update (regexp are supported)

vars/Debian.yml

@@ -1,3 +1,3 @@
 ---
-unattended_origins_patterns:
+__unattended_origins_patterns:
   - 'origin=Debian,archive=${distro_codename},label=Debian-Security'

vars/Ubuntu.yml

@@ -1,3 +1,3 @@
 ---
-unattended_origins_patterns:
+__unattended_origins_patterns:
   - 'origin=Ubuntu,archive=${distro_codename}-security,label=Ubuntu'