strict tag updates

Optionally treat tags that don't end with 'latest' as immutable and reject updates.

tags 1.1 and foo are immutable
tags latest and 1.1-latest can be updated

Config key strict_tags=true enables this behavior