Return distinct custom_* tag keys in use for the caller's scope.

Drives dynamic grid columns and filter chips. The caller only sees
keys from requests they could list — queryset scoping handles that,
and the default filter backend additionally narrows by the active
?recovery_program=<csv> selection so multi-customer roles
(SuperUser, CustomerAdministrator, PartnerCreator, PartnerAdministrator)
don't see chips from customers outside the active selection.

The union covers two stores:

• ReturnRequest.tags for every request in scope.
• RecoveryProgram.tags for every program reachable via those
  requests.

Both are searched by ProcessingFilter (the device-status grid
also folds in tracking.return_request.tags, which shares the
ReturnRequest table and therefore contributes no new keys).
Listing only ReturnRequest keys would hide program-only tag
columns from the grid even though the filter would match on them.

Implementation note: this is intrinsically a scan. Enumerating the
union of keys across the scoped rows is not a question GIN answers
(GIN accelerates point lookups like @> and ?, not set
construction). No index helps here until volume warrants caching.