mrf/tag_policy.ex: Add some documentation

mrf_tag:disable-remote-subscription exact way of working is quite
unclear to me. Is it the requester that is denied if they have a tag,
or is it the requestee if they have one?