Per user/group access levels for Protected Tags

What

Ability to choose who can access a protected tag by group or user.

Why

To provide more flexibility and mirror options for protected branches

Screenshots

Acceptance criteria

• Changelog entry added, if necessary
• CE MR to backport refactorings
• Documentation created/updated
• API support added
• Tests added for this feature/bug

What are the relevant issue numbers?

Expands upon https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/10356

Closes #2132 (closed)