Support a set of required tags on runners

Description

I'd like to have runners require certain tags exist on the jobs they take. For example, a runner using the docker executor should be able to require that the jobs it takes have a docker tag (e.g., to avoid taking some job that assumes it is run on bare metal or is for Windows). Having to add "negative" tags to force jobs to not go onto runners with special permissions is not scalable since editing runner tags after creation is not trivial.

Proposal

The ability to mark some tags as "required" for a runner.