feat(tags): Add support to bulk unassign tags

[Rutvik G (rutvik-gs)]

Problem

tags assign --query gave us bulk tagging, but there was no way to bulk untag. So this PR adds that. Similarly, there was also no way to stop a bulk job once submitted. A mistyped CenQL query on a broad corpus had to run to completion, and operations could only watch it happen. Hence cancel operation support was also added.

Technical Changes

• tags unassign gains a bulk mode — --all removes every assignment, --created-before/--created-after remove a window. Either submits a bulk_delete job and reports the tracking operation, with --wait/--timeout reusing the shared poll loop. Bulk is entered only by those flags, never inferred from missing asset arguments, and cannot be combined with explicit assets or --input-file. --all can't be narrowed by a time filter — that combination contradicts itself and is rejected.
• tags operations cancel <tag> <op-id> — new subcommand, confirms unless --yes. Deliberately does not treat a cancelled status as a failure the way --wait does: a successful cancel exits 0. Cancelling is not a rollback, and the prompt says so.
• internal/pkg/clients/censys/tags.go — BulkDeleteTagAssignments (absent timestamps send an empty body, which is the API's "delete ALL") and CancelTagOperation.
• Shared, not duplicated — the just-submitted-job wait path is now one followSubmittedOperation used by both bulk assign and bulk unassign, so the interrupt-vs-track-hint branch can't drift. ValidateTimeWindow is exported so unassign rejects an inverted window in PreRun and the service keeps its guard — the same double-validation assign uses for a blank --query, which is what lets it fail before credentials are needed.

How to Test

Fast path:

make mocks && git diff --exit-code   # generated code must be in sync
make all && make cover-check
make e2e

Live walkthrough — self-cleaning, one uniquely named tag:

export PATH="$PWD/bin:$PATH"
TAG="demo-$(date +%H%M%S)"
censys tags create "$TAG" --privacy private
censys tags assign "$TAG" 8.8.8.8
censys tags get "$TAG" --asset-count          # Assets: 1
censys tags unassign "$TAG" --all --wait --yes # 202 → succeeded, 1/1
censys tags operations list "$TAG" --type bulk_delete
censys tags delete "$TAG" --yes

[Ben Schwartz (btschwartz12)]

LGTM!