Revamp tag handling and display

Add an additional protected class, limit manipulation to one at a time,
and ensure future flexibility. Also makes display consistent with other
VM elements.

daemon-common/zkhandler.py

@@ -579,6 +579,12 @@ class ZKSchema(object):
             'meta.tags': '/tags',
             'migrate.sync_lock': '/migrate_sync_lock'
         },
+        # The schema of an individual domain tag entry (/domains/{domain}/tags/{tag})
+        'tag': {
+            'name': '',  # The root key
+            'type': '/type',
+            'protected': '/protected'
+        },
         # The schema of an individual network entry (/networks/{vni})
         'network': {
             'vni': '',  # The root key