Only update docker when run explicitly

Docker should only be updated when run explicitly as it currently
requires a re-run of the complete playbook afterwards (does not work for
single-tag deployments e.g.) since it will recreate caddy container and
lose all reverse proxy information.

roles/docker/tasks/Ubuntu.yml

@@ -30,7 +30,18 @@
     - repository
   become: true
 
-- name: Ensure latest docker-ce installed
+- name: docker-ce is installed
+  ansible.builtin.package:
+    name: "{{ packages }}"
+    state: present
+  tags:
+    - apt
+    - download
+    - packages
+  become: true
+  notify: Handle docker daemon
+
+- name: Latest docker-ce is installed
   ansible.builtin.package:
     name: "{{ packages }}"
     state: latest
@@ -38,6 +49,8 @@
     - apt
     - download
     - packages
+    - docker
+    - never
   become: true
   notify: Handle docker daemon