Team admins & team maintainers can manage labels

[dherder]

• prospect-hubble:
  • Slack thread: https://fleetdm.slack.com/archives/C0740213DPT/p1731006486800909
  • Gong snippet: https://us-65885.app.gong.io/call?id=6346563697478415477&highlights=%5B%7B%22type%22%3A%22SHARE%22%2C%22from%22%3A850%2C%22to%22%3A972%7D%5D
• @noahtalerman: User requested this because TODO
  • @username: In the interim TODO
  • @username: Eventually TODO

---

User stories

• 24098

[noahtalerman]

Problem

from prospect-hubble: If team can have queries / policies unique to the team and not visible to other users or teams on the platform, I don't know why labels would only be global. I can see some limited use cases for a global label applying across disparate teams, but I think the much much more likely usage is labels in use by individual teams, and team-specific labels should exist.

the endpoint team managing workstations shouldn't be seeing tags that the system operations team needs to make for management of their servers, nor should they be forced to collaborate on intentionally ambiguously named tags that both teams could consume

The above request is to be able to specify a team based permission for the reading, creation, update and deletion of labels. The goal is to be able to scope policies that are enforced on a team basis with the usage of labels. In order for that to happen, labels need to be controlled at the team level, not just global.