Add system tag assignability check with groups

Whenever a user is not an admin, a tag is visible but not
user-assignable, check whether the user is a member of the allowed
groups.