Fix docker-push.sh execution

[Groxx]

Why this commit exists:

"build and push master" buildkite steps are failing, due to both:

• their images not having unzip available
• protoc failing to run on alpine after adding unzip, e.g. /bin/sh: .build/bin/protoc: not found
• pip v21 dropped support for python2 entirely, and cqlsh hasn't been updated in nearly 4 years and is stuck on 2.7

This fixes that by 1) adding unzip, and 2) not executing thrift/proto codegen during those release builds (and in other locations).

---

Lots more details:

Protoc is apparently incompatible with alpine images, it has something to do with musl and (g?)libc incompatibilities.
In the alpine images, sh complains .build/bin/protoc: not found, but after some more digging you can see ldd has more info:

ldd .build/bin/protoc
	/lib64/ld-linux-x86-64.so.2 (0x7f9b1f366000)
	libm.so.6 => /lib64/ld-linux-x86-64.so.2 (0x7f9b1f366000)
	libpthread.so.0 => /lib64/ld-linux-x86-64.so.2 (0x7f9b1f366000)
	libc.so.6 => /lib64/ld-linux-x86-64.so.2 (0x7f9b1f366000)
Error loading shared library ld-linux-x86-64.so.2: No such file or directory (needed by .build/bin/protoc)
Error relocating .build/bin/protoc: __strftime_l: symbol not found

After a bit of experimenting, it seems that the semi-common tricks of "install libc6-compat or gcompat" do not work for protoc.
I'm not really sure why.

So our options are basically one of:

• Abandon alpine for this build section. It just builds binaries that are copied to the next step, so it won't affect the final image size anyway. (this builds successfully, but I have not checked the resulting binaries)
• Keep alpine, build protoc from source, hope it compiles successfully against musl
• Keep alpine, but don't do codegen in this build (this works)

Option 3 seemed worth trying in depth. After some toying around and (as usual) learning something new about Make, I found this tactic.
It appears to be well-supported and consistent, so I'm OK with using it, though it's rather strange at first glance.
Binaries are still downloaded/built during release builds with this approach, but that seems like a relatively low-risk / low-cost consequence.

This all also means that devs will download and build these tools as part of a normal make bins, but similarly will not run codegen unless needed.
Since that kinda helps "prime" the dev environment, that seems totally fine / possibly even a good thing. Codegen should still run when necessary though.

[coveralls]

Coverage increased (+0.04%) to 61.683% when pulling 1f84683 on fix_release into 710cd61 on master.