Support `--skip-tags`

Add `--skip-tags` flag to match ansible-playbook's native functionality. Currently only `--tags` is supported, requiring workarounds like `trellis exec` when needing to exclude specific tags (like skipping letsencrypt due to rate limits)

Ref https://discourse.roots.io/t/provision-but-exclude-letsencrypt-task-s/29962