Fix the tag editing capabilities of everyone on a partner

[r-ferrier]

fixes #2174

Description

• ensures root users can still add/remove any tag
• ensures partner admins can still add any category or facility tag and remove any partnership tags
• allows partnership admins to edit tags without accidentally removing tags they can't see in the process
• prevents partnership admins from removing partnership tags that don't belong to them
• warns partnership admins if tag removal is likely to boot a partner out of their scope

Implementation notes

I've used a bespoke select2 style controller for this again, like we did for controlling the partners that users admin for. This is mainly so there is instant and obvious feedback, and because we don't actually need to make these moves impossible at a database level, we just want to ensure admin users are fully aware of how certain actions will impact their reach.

I've added tests for the new methods in the helper but not for the JS logic for the same reasons mentioned in the related PR.

(related PR here)

[ivan-kocienski-gfsc]

Looks nice, good work.

(Didn't know you could def policy_scope in tests like that)