CI: Pre-merge jobs should not override the "latest" container tags

Currently, any pre-merge series that cuts a new release of a container will also update the latest tag. This is problematic because this means that unmerged code could potentially be picked up in production.

Let's fix that by limiting the upload to the latest tag to the master branch.