Implement tag immutability feature

Context

Related to Container Registry: Tag immutability feature (&15139 (closed)). See the epic description for additional context as well as an overview of the overall implementation plan.

Task

While ideally we'd wait for Create models for container registry tag immuta... (gitlab#515996 - closed) to be complete first, we can implement the registry-side changes in advance, as we know how the emitted JWT tokens will end up looking like.

The registry implementation details are described here.