As was done for categories in #4750, let's add private tag__in, tag__and, and tag__not_in query vars.
Let's also decide on how to specify intersections and unions in the public query vars. We have tag_id and tag. tag_id currently takes a single numeric ID, and tag takes a single tag slug. tag is the var we use when creating links and such. tag_id isn't exposed anywhere at the moment. I think we can extend tag to allow the use of "+" to request tag intersections and commas to request unions. Only one or the other can be specified in the same request.
tag+tag2+tag3
tag,tag2,tag3