Make the Create/Delete Tag REST API raise an event that can be cancelled -
Customer use case:
Currently we have a custom post-receive-hook that disables tag deletion, and I don't want that to be able to be bypassed from a REST API