policy add/remove tags

Adding the ability to associate/disassociate tags with a policy.  These
actions are idempotent in that adding or removing a tag that is already
associated/disassociated does not constitute an error.

Tests included with some adjustments to fabricators to suit.