Also tag default branch build as ":latest"

This adds a convoluted approach via temp-pull and publish for both ":master" and ":latest".

Rather than hooking into a post-build step, I'm adding it in the build pipeline via shell script to avoid having to make too many job alterations.