Add support for `restrict_update` to Rulesets convenience rules

It would be useful to add a `restrict_update` key to the convenience syntax for Rulesets to govern the presence or absence of the `update` rule.

This rule is not very useful for branches, but it should probably default to `true` for tags, making them effectively immutable.

Start by locating the Rulesets convenience syntax and its schema or validation tests; the issue does not name a file or test. Add the restrict_update option, preserve sensible branch behavior, and make tags default to true so the resulting ruleset governs the update rule as described.

Written by the indexing model from the issue text.