Allow reading of symlinks in /etc/puppet

It's a standard practice to symlink modules into /etc/puppet/environment.
Policy does not allow reading of symlinks which leads to denials.

Also adding `TAGS` file to `.gitignore`.