ephemeral tag generation

- tags now created ephemerally for incoming events, based on strings in the entity and check names
- notification rules now consider these, matching against tags in the rules