CI: make publish job run only on tagged master

Author: Tomcat-42

.github/workflows/publish.yml

@@ -20,9 +20,9 @@ jobs:
   publish_crate:
     runs-on: ubuntu-latest
     name: Publish Crate on New Tag
-    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') && github.ref == 'refs/heads/master'
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - uses: actions-rs/toolchain@v1
         with:
           toolchain: stable