Pass required tags to repo update command.

Instead of assuming we're building with the tags from the system wide product
certs, have the caller specify the tags.