Docker build image workflow should pin the `latest` tag onto the most recent version

[dgpalmieri]

Currently, all docker pulls without specifying a tag will fail, as we do not specify the default latest tag. We should add this to our Docker Build workflow.

[bbuechler]

Some might call this a feature! Unpinned image versions are like unpinned pip or node versions. Certainly it can be convenient, but it often causes problems down the road.