fix: validation permission on tag creation (#22753)

* fix: validation permission on `tag` creation

* refactor: apply checks on all operations

Add/remove both are controlled by update

---------

Co-authored-by: Ankush Menat <ankush@frappe.io>

frappe/desk/doctype/tag/tag.py

@@ -48,8 +48,6 @@ def add_tags(tags, dt, docs, color=None):
 		for tag in tags:
 			DocTags(dt).add(doc, tag)
 
-	# return tag
-
 
 @frappe.whitelist()
 def remove_tag(tag, dt, dn):
@@ -153,6 +151,7 @@ def update_tags(doc, tags):
 
 	:param doc: Document to be added to global tags
 	"""
+	doc.check_permission("write")
 	new_tags = {tag.strip() for tag in tags.split(",") if tag}
 	existing_tags = [
 		tag.tag