This lets us configure cross-project permissions while ourselves needing
minimal permissions, but also gives us a nice hook for future lockdown
of object-level permissions.
This lets us use the new shared cluster tags, for shared networking
objects - in particular subnets.
We continue to add the existing tags also, for compatability. When we
add direct management of shared networks, we will likely address that.