Do not always push images

[Bronek]

This stops unconditional push of container images e.g. in pull_request events.

The docker/build-push-action in most (except for the recently added GCC one) have the line ending with push=true, e.g.

outputs: type=image,name=${{ env.CONTAINER_IMAGE }},push-by-digest=true,name-canonical=true,push=true

The meaning of this last push=true is unclear, given the sane action also takes push parameter

push: ${{ github.ref_type == 'branch' && github.ref_name == github.event.repository.default_branch }}

However, we are pushing a lot of images, including from pull_request events, so the push=true at the end of outputs seems a natural suspect to cause this.

[Bronek]

unfortunately, Github does not seem to accept if: ${{ env.PUSH }} at a job level, so we have to repeat the full condition here.