Automatic worker filter setup on targets. Multi-tenant architecture.

**Is your feature request related to a problem? Please describe.**
We are setting up a multi-tenant boundary architecture. Each tenant (boundary organization) provides its private workers. These workers can only be used by that organization; so all targets in the projects inside the organization must have a filter configured.

Also, I think it could be an issue having workers configured with tags (all workers with tags), that are able to process connections to targets without any filter configured.

**IMHO**:

- If a target has no worker filters, any worker without tags should be able to process the connection.
- If a target has no worker filters, workers with tags should NOT be able to process the connection.
- If a target has worker filters, only matching workers should be able to process the connection.

**Describe the solution you'd like**
Hooks, events, or any organization policies to enable `targets` to be configured with some `worker` filters on creation.
https://www.boundaryproject.io/docs/concepts/filtering/worker-tags#target-worker-filtering

**Describe alternatives you've considered**
I can create predefined targets for the tenants, but if the tenant admin creates new targets, the configuration is not propagated automatically (i can restrict tenant admin to create targets... ). I considered also running a database query/trigger, but I don't feel comfortable with this kind of solution.

**Explain any additional use-cases**
This is something more people will find interesting while running multi-tenant boundary architectures.

**Additional context**
Im available to talk about more issues like these.