[PATCH 0/3] fix #7864: allow pool-scoped privileges to create VMs with tags

[jlcusinato <jlcusinato@neverhack.com>]

Pool-scoped automation can create VMs and containers in its pool, but the
create fails as soon as --tags is passed (403 on /vms/<vmid>,
VM.Config.Options); regressed with commit a929b3e ("vm_create: check tag
permissions if setting tags") in qemu-server and its pve-container
counterpart 7a57f63 ("check_ct_modify_config_perm: check for tags
permissions with 'assert_tag_permissions'").

Root cause and reproducer: bug 7864 [0]. These are the patches already
attached there (code by Felix Winterhalter <felix@ranovus.com>, all three
contributors CCed), posted per the maintainers' request (comment #6);
neither has been active on the bug since September 2026 and the list never
received a posting, hence this submission. crandler's fix for the {} -> ''
defect (comment #5) is rolled into the qemu-server patch; the pve-container
message was corrected after dreadfulbunny's data point (comment #7) showed
that container create is affected too. Provenance is preserved in the
commit messages (Signed-off-by / Reported-by); my individual CLA is on
record with Proxmox (October 2026).

Merge order: pve-guest-common first; qemu-server and pve-container then.
Per-patch notes describe deltas from the Bugzilla versions. Not
runtime-tested (no test node); testing feedback welcome.

[0] https://bugzilla.proxmox.com/show_bug.cgi?id=7864