Add best-practices for tagging (especially when to tag at event or attribute level) about misp-book

[Wachizungu]

I did some testing for this and am preparing an update for the doc. I'm curious about the following scenario though:

An event with most of the attributes being tlp:green, but a couple being tlp:amber and tlp:red. If I put tlp:green at the event level and not for the individual attributes that are tlp:green, the "These tags should be valid for any individual attribute, thus indicator associated to this specific event." is not followed as the tlp:green does not apply to the attributes that are tlp:amber and tlp:red. This has some practical consequences. If you export attributes with restSearch, the event level tlp:green tag is not added for the ones which are supposed to inherit the tlp:green tag from the event. If you do include the event level tags (there's a flag for that) you now have some attributes that have a combination of tlp:green and (tlp:amber or tlp:red). This case would require some extra automation to get the data back in a correct state. Another note: if you do restSearch attributes filtering on tlp:green, you get the attributes with tlp:amber and tlp:red as well unless you specifically filter to exclude them.

From the training video (https://youtu.be/Jqp8CVHtNVk?t=2448) I understand the above scenario (my interpration might be wrong), putting the most generic tag at event level and exceptions at attribute level, is still the best practice though. Please let me know if that is the case, if so I'll document it like that while noting things to keep in mind.