Tag protection check

[thomasboni]

Problem

Plumber checks branch protection (branchMustBeProtected) but says nothing about tags. Unprotected tags are a real release-integrity gap: anyone with push access can create or move a tag, and tags are what release workflows trigger on and what users pin actions to. The tj-actions attack is the canonical case of a moved tag shipping malicious code.

Suggested by @samrocketman in the CDF Slack (reaction to the "when factory matters more than code" blog post): "Adding tag protection is a good practice as well", on top of the branch protections the article mentions.

Proposal

New control : verify that tag rules exist for release tag patterns (e.g. v*).

• GitHub exposes tag rules through the same rulesets API we already use for branch protection since [TEST] Test of new beta release with Rego & GitHub #158 (/rules/..., ruleset conditions on refs/tags/*), so the collector work builds on the existing one
• config shape similar to the branch control: tag name patterns to require rules for
• what to check first: tag creation/update/deletion restricted (immutable release tags), and flag repos with release workflows triggered on tags but no tag rules at all

Token requirements should be documented from day one, same lesson as #379.

Notes

• GitLab side has protected tags as well, cross-provider control like branchMustBeProtected
• pairs naturally with actionsMustBePinnedByCommitSha: SHA pinning protects consumers of an action, tag rules protect what this repo itself releases