Don't build a separate docker image for `latest` after a release

This issue has been migrated from [#11418](https://github.com/matrix-org/synapse/issues/11418).

---

A user in Synapse admins [noted](https://matrix.to/#/!ehXvUhWNASUkSLvAGP:matrix.org/$Mn9Kcyv0TmeXMUYZyu62dcTR-T2xZtfzosO2SGzuVvo?via=matrix.org&via=matrix.breakpointingbad.com&via=libera.chat) that the docker images for 1.47.1 and latest had different checksums. An initial investigation suggests that this is because they are built separately with different timestamps in logs and pyc files. Indeed, 1.47.1 is built when we create its tag; whereas `latest` is continuously built from `master` and `main` branches.

Given that we do not actively develop on `master`, I suggest we
- remove `on.push.branches` from `docker.yml`
- amend the release instructions with a step that changes the `:latest` to the `:vX.Y.Z` tag created as part of the release

Doing so will avoid us having to build the docker image twice, which saves time (particularly for the slow, emulated ARM build).