Move GCM tag size/value validation farther forward

this makes it easier by not requiring future backends to implement the same checks