docker-image: do not push images for pure CI builds

To keep the registry cleaner, we don't push an image with a CI tag when we build it for feature branches, we just keep it locally.

This does mean that when we do want to push the image, we either need to obtain it some other way, or build it (again) in the publish job. As the amount of times an image is published is not that frequent, building the image again should be fine, saving space in storing artifacts.