[#12176] feat(server, client): expose policy-on-tag APIs

[roryqi]

What changes were proposed in this pull request?

1. Add DTOs for policy-to-tag associations and selectors.
2. Add REST APIs for listing, adding, and removing associations.
3. Add the corresponding Java client APIs.
4. Add authorization expressions and privilege definitions.
5. Resolve metadata object policies from effective tags and matching selectors.
6. Stop exposing direct object-policy mutation routes.

Why are the changes needed?

Users need REST and client APIs to manage policies on tags. Metadata object policies should be derived from effective tags instead of legacy direct policy relations.

Fix: #12176

Does this PR introduce any user-facing change?

Yes. This PR adds policy-on-tag REST and Java client APIs and changes metadata object policy resolution to use effective tags.

How was this patch tested?

• Spotless checks for the affected Java modules
• Targeted Core, Common, Server Common, and REST tests
• Java client compilation
• git diff --check