Inject agent tags into per-agent policy under agent.tags

## Summary

Part of the "Agent tags propagation" design (related issue: elastic/kibana#271551). Fleet agent tags are set on the agent record (`.fleet-agents`) but the agent itself has no visibility into them today. Fleet Server needs to inject tags into the per-agent policy so the agent can attach them to collected events.

## Proposed change

- When compiling the per-agent policy, inject the agent's tags under `agent.tags` (e.g. `agent.tags: ['tag1', 'tag2']`), similar to how API keys are injected into the per-agent policy today.
- Tags can change independently of the policy (e.g. edited in Fleet UI without a policy revision bump). To handle this:
- Store the latest tags sent to the agent in a new field, e.g. `agent_tags_hash`, on the fleet agent document.
- On agent checkin, compare the current tags hash to `agent_tags_hash`. If different, trigger a new policy change action carrying the updated tags.

## Out of scope / alternatives considered

- Adding processors directly in Fleet Server to inject tags was considered but rejected — it would require Fleet Server to have too much knowledge of, and ability to manipulate, agent policy content.

## Related

- Related issue: elastic/kibana#271551
- Kibana issue: elastic/kibana#276433
- Elastic Agent issue: elastic/elastic-agent#15375