[backend] avoid applying sourcepublish filter twice

We need to filter by the hosting project, but not by the project
where the build happened for released content.

This information does not exist in the events, so rely on the
filtering of bs_publish only