Tighten dependencies for tag-related jobs

The "merge-tag" and "update-stable-tag" jobs currently use the
"manual_release_job_qa" YAML anchor, which makes them depend on the
"staging" job.  Meanwhile, both of these jobs require the tag they were
created for to be public for them to work.  While this is harmless, as
these jobs will simply fail if they are run too early, it still makes
sense for them to depend on the "publish" job instead, if only to reduce
confusion in the pipeline view.  Adjust the "needs" key for the
"merge-tag" and "update-stable-tag" jobs accordingly.

.gitlab-ci.yml

@@ -2161,6 +2161,10 @@ merge-tag:
   <<: *manual_release_job_qa
   variables:
     GIT_DEPTH: 100
+  needs:
+    # TODO: if necessary, update job name after pushing tags from within CI is implemented
+    - job: publish
+      artifacts: false
   script:
     - >
       "$CI_PROJECT_DIR"/bind9-qa/releng/merge_tag.py --tag "$CI_COMMIT_TAG"
@@ -2175,6 +2179,10 @@ update-stable-tag:
   <<: *manual_release_job_qa
   variables:
     GIT_DEPTH: 1
+  needs:
+    # TODO: if necessary, update job name after pushing tags from within CI is implemented
+    - job: publish
+      artifacts: false
   script:
     - >
       "$CI_PROJECT_DIR"/bind9-qa/releng/update_stable_tag.py --tag "$CI_COMMIT_TAG"