[WIP] entity tags support, including REST API (but not GUI)

structure is about right but tests not yet passing.  for review only.
do we need to protect this call also with EntitlementManager, maybe not in thin PR, though