Tag-Based Security in C: Writing and Specifying Flexible Protection