For other people reaching this post, the answer to this is to use some kind of authentication on the REST endpoint, that only allows trusted users to create new users.
Otherwise anonymous users would be able to create admins and crash the site.
So this code is correct,
but the problem is that the user calling the endpoint has to ...
They are relations, so firstly you need to create the tags with the taxonomy REST service.
You must take into account they are entities ( node and taxonomy_term ) and the field_tags field only stores the reference to the entity taxonomy_term.
Once you have created it, you will have to add the tags in the following way in your node ...