Feature: Add tag-based host exclusion via exclude_tag setting

[berlikm]

Summary

Adds a new exclude_tag plugin setting that allows excluding hosts from Zabbix sync entirely via a ZabbixTag assigned to any object in the inheritance chain (Role, Platform, Site, SiteGroup, Manufacturer, or directly on a Device/VM).

How it works

1. Create a ZabbixTag with tag='do_not_monitor' (or any name) and any value
2. Assign it to a DeviceRole (e.g. 'Desktop PC'), Platform, Site, or individual Device/VirtualMachine
3. Set 'exclude_tag': 'do_not_monitor' in PLUGINS_CONFIG
4. All hosts inheriting that tag are excluded from sync — existing Zabbix hosts are deleted

The tag is filtered before Jinja2 rendering in get_tag_attributes(), so it never reaches Zabbix as a host tag.

Dependencies

Stacks on PR #115. Merge after #115.

Testing

7 new tests covering: exclusion disabled (default), tag present/absent, skip sync when excluded, delete on exclude, and no-delete when already decommissioned. All 1076 existing tests pass.

Part of #121.

[berlikm]

This PR is part of the zero-touch provisioning feature set described in #121. Please see that issue for the full architecture and motivation.

[berlikm]

Conflict resolution note for rebase

When rebasing this PR after #115 lands, there will be a conflict in nbxsync/utils/sync/hostsync.py on the tag loop:

• Ours (this PR): exclude_tag = self.pluginsettings.exclude_tag + for assigned_tag in self.context.get('all_objects', {}).get('tags'): + exclude_tag filter
• Theirs (feat: Site/SiteGroup/Region inheritance, recursive ancestry, exclusion and inherited sync UI #115): for assigned_tag in (self.context.get('all_objects', {}).get('tags', []) or []):

Correct resolution: Combine both — keep the exclude_tag filtering from this PR, but use #115's or [] normalization on the for loop:

exclude_tag = self.pluginsettings.exclude_tag
for assigned_tag in (self.context.get('all_objects', {}).get('tags', []) or []):
    if exclude_tag and assigned_tag.zabbixtag.tag == exclude_tag:
        continue

Verified in the integration-test branch: 1135 tests pass, E2E confirmed.

[berlikm]

Superseded by #115, which now consolidates the hierarchy / site-mapping slice of #121 (#115 + #116 + #124 + #113 + #114). Commits from this PR are preserved there with their authorship.

Closing to keep hierarchy review in one place. Template rules, bindings, CI, OOB and rendering PRs remain separate.