Add support for excluding tags from restrictions

Allow user restrictions to provide an excluded map of packages and tags
rather than just packages.

Bug: 187421886
Test: manual
Change-Id: I8f90ba6cdd288068664b352fdb540d0f11fe3dfc