Tag and push docker images when building them only if $DOCKER_PUSH is set. Set this variable on manual CI jobs on the master branch, preserving existing behavior.
Add a new CI job rule that runs only on merge requests and only for Dockerfiles that were modified. It doesn't have DOCKER_PUSH set, so it will only build the image, and won't tag or push the image.
This way we can know if merge requests break the build for the docker image they are modifying before we merge the change.