Resource tags, filtering by tag

As discussed in RFD 4, resources are supposed to have tags and you're supposed to be able to filter lists by tag. There are two parts to this statement:

• Adding tags to resources, presumably in IdentityMetadata, which makes it relatively easy
• Filtering resources by tag, which is a lot more complicated and open-ended

There are lots of open questions about how to do filtering, for example: what is the scope of the query? Is it:

• Give me all the instances in this project with this tag (or this tag substring)
• Give me all the resources in this project with this tag (or tag substring)
• Give me all the resources I can access with this tag (or tag substring)

Or do we keep things really simple and just add query params to existing list endpoints that allow filtering by tag? Etc.

Start with RFD 4, especially its tags section, then inspect the resource metadata represented by IdentityMetadata and the existing list endpoints. The scope and query behavior for tag filtering need to be decided before implementation; done means the tagging model and filtering semantics are specified and implemented consistently.