Automate tag hygiene controls

[puerco]

This PR adds the missing tag protections control to sourcetool setup. We were missing the ruleset automation and support int the sourcetool package. This adds all the missing parts:

> sourcetool setup controls  --help

sourcetool setup controls configure a repository for SLSA source

The setup controls subcommand configures the specified SLSA security
controls in a repository. As opposed to "setup repo", this subcommand lets you
configure each security control individually.

To use this subcommand you need to export a GitHub token as an environment
variable called GITHUB_TOKEN. To configure the branch rules, the token needs
admin permissions on the repo. For the other configuration it is only required
as an identity source.

The values for --config are as follows:

CONFIG_BRANCH_RULES
Configures push and delete branch protection in the repository, required to reach
SLSA source level 2+. 

CONFIG_TAG_RULES
Configures udpate, push and delete protection for all tags in the repository,
this is required to reach SLSA source level 2+. 

CONFIG_GEN_PROVENANCE
Opens a pull request in the repository to add the provenance generation workflow
after every push. 

CONFIG_POLICY
Opens a pull request on the SLSA policy repository to check in a SLSA Source 
policy for the repository.

Setting up repository forks

The controls that open pull requests require that you have a fork of the
repositories. Make sure you have a fork of the SLSA source policy repo and
a fork of the repository you want to protect.

Usage:
  sourcetool setup controls owner/repo --config=CONTROL1 --config=CONTROL2 [flags]

Flags:
      --branch string      name of the branch
      --config strings     control to configure [CONFIG_POLICY CONFIG_GEN_PROVENANCE CONFIG_BRANCH_RULES CONFIG_TAG_RULES]
      --enforce            create enforcement rules
  -h, --help               help for controls
      --interactive        confirm before performing changes (default true)
      --owner string       user or oganization that owns the repo
      --repo string        name of the repository
      --user-fork string   GitHub organization to look for forks of repos (for pull requests)

Global Flags:
  -c, --commit string            commit digest (sha1)
      --expected_issuer string   The expected issuer of the attestation signer certificate
      --expected_san string      The expected SAN string in the attestation signer certificate
      --github_token string      the github token to use for auth
      --tag string               The tag within the repository