Update acls to enforce pushing signed tags

We don't ever want non-signed tags anywhere - enforce this. (also,
the old setting is not a more permissive version, it is explicitly
a setting for only allowing unsigned, unannotaged tags)

Change-Id: I7836860f9e62bcb169bc13c5e3b5b5ecf6d325a1
Merge "Update acls to enforce pushing signed tags"