Add auth check to delete tag endpoint

Prior to this change the delete tag endpoint did not enforce protected
tag logic. Our protected tags UI only allows owners to delete tags which
are protected, however, our API allowed anyone who can push to attempt
to delete the tag. We were not exposed as the logic downstream would
reject the change during the tag_check phase, however, it meant that
users would see a 500 error instead of a nice 403 error.

This change adds a new policy for the Gitlab::Git::Tag model which
checks if the tag is currently protected.

If the tag is not protected we allow developers+ to delete them.
If the tag is protected we only allow owners to delete them.

Co-authored-by: @nav-j
Changelog: fixed