gitlab-ci: Apply the "latest" tag only on success

Always tag built images as test-$COMMIT so that we keep a bunch of those around in case a rollback is needed, using a GitLab Container Registry cleanup policy to keep storage under control.

https://docs.gitlab.com/ee/user/packages/container_registry/#cleanup-policy

We can then apply the latest tag to officially publish the built images only after the tests have passed successfully.

This allows projects to set up a cleanup policy tailored to their needs and to easily retain images that are needed for long term support, for instance the ones used to on release builds.

The following policy has been set up in the project configuration:

• Expiration interval: 7 days
• Expiration schedule: every day
• Number of tags to retain: 5 per image name
• Tags with names matching this regex pattern will expire: (test-.*|wip-.*)