tag list | suggest | approve | reject and --tag on product create/edit #68

Pick, suggest and review the tags products carry.

Depends on source-cooperative/source.coop#648 for the /tags endpoints. Setting a product's tags already works: source-cooperative/source.coop#647 added tags to POST /products/{account_id} and PATCH /products/{account_id}/{product_id}.

tag commands

• tag list answers GET /tags: the approved tags, the list product list --tags filters on. Anyone may run it, signed in or not.
• tag list --pending answers GET /tags?pending=true: the tags awaiting review, with who suggested each and when. Only admins may list them.
• tag suggest <tag> answers POST /tags with { "tag_id": "<tag>" }. The API trims and lowercases the tag, so print the tag it answers, not the one typed. A 201 means the tag was added and awaits review; a 200 means it already existed, which is not an error. A retry is therefore always safe.
• tag approve <tag> answers PATCH /tags/{tag_id} with { "pending": false }. Admins only.
• tag reject <tag> answers DELETE /tags/{tag_id}, which takes the tag off every product carrying it. tag reject <tag> --replace-with <approved-tag> (or tag merge <tag> <approved-tag>) passes ?replace_with=, which puts the approved tag in its place instead. Admins only. Both answer 409 for a tag that has already been approved, so they never strip an approved tag from products.

URL-encode the tag in the path: tags may hold spaces (sea%20ice).

Tags on products

• product create --tag <tag>, repeatable, sends tags as a list.
• product edit --tag <tag> (repeatable) replaces the product's tags with exactly those given; product edit --clear-tags sends "tags": []. Leaving both out sends no tags, which keeps the product's tags as they are. If --add-tag/--remove-tag read better, they can compute the new list from product view's, since the API only replaces the whole list.
• A tag outside the approved list is refused with a 400 problem that names the unknown tags; print it and point at tag suggest. A tag the product already carries is accepted even if it has since left the list.

Tags awaiting review show only to people who may edit the product, so product view shows them to the product's editors and to no one else.

As the epic says, the CLI validates nothing itself: it sends the request and shows the API's error. Errors are now RFC 9457 problems (#67), so a 400 lists each field's problem under errors. --json and the shared conveniences from #28 apply to tag list. Add a CLI path to the "Tags" part of docs.source.coop docs/using-source/create-a-data-product.md once these ship.