Expose ensure param for container runtime package

[ananace]

Ran into the requirement to have a more specific CRI version in a few cases, so exposing the ensure parameter to make that particular setup easier to manage.