ci: harden docker workflow

[Mirko-von-Leipzig]

This PR couples the docker image tagging to run after a github release, instead of on a tag being pushed.

Our current release workflow is:

1. Push version tag
2. Docker workflow runs and uploads an image. This includes tagging the image with the version and latest
3. Formally release on github

External parties moniter our docker images for new releases, instead of our github releases. So what occasionally occurs is that we find a bug between steps (2) and (3) but since some users already have the "release" via dockerhub we cannot properly abort the faulty release.

What this PR does is change the workflow to:

1. Push version tag
2. Docker workflow runs and uploads an image without tagging it
3. Formally release on github
4. This triggers another workflow which will tag the image from (2)