Add ACL features to (global) tags

Is your feature request related to a problem? Please describe.
There are use cases that make access right management cumbersome (with the directory structure of file storage being a tree) hard without having per-file access control. A typical application requiring this would be any kind of document management system-like usage of shared folders where certain documents should not be visible to anyone outside a group (e. g. only accounting and the department who ordered the stuff seeing invoices in the "incoming" directory) .

Describe the solution you'd like
Revamping the entire core to have file access control on every file would probably become a nightmare and (see current papers on the topic) might not be necessary. A just as versatile model would be adding ACLs (only for groups if you want to simplify -- single users could be put in arbitrary groups containing only one user) to the existing (global) tags. Tagging a file as "accounting" no matter where will add or set the specified access rights to the file (but only if the directory is shared with a user who is member of that group).

Describe alternatives you've considered
Using different software. Putting files in separate directories and sharing each of these leaf nodes to different groups of accounts is completely impractical.

Additional context
It's the only feature missing to replace most DMS and integrate them into Nextcloud.

The issue proposes adding group-based ACL behavior to global tags so tagged files inherit access restrictions. No files, tests, entry points, or acceptance criteria are named; first identify the relevant tag, file-sharing, and group-permission code, then define how tag-based visibility should interact with directory shares before implementation.