I know you definitely should not rebase commits that you’ve already pushed to a remote, as amending history after it has been pushed can cause messes for other developers.
Is it OK though to move a tag in your local repository (git tag -a -f <tagname>), delete the remote tag (git push origin :refs/tags/<tagname), then push the new tag (git push --tags)?
What about non-annotated (lightweight) tags? What about branches?
Yes, it’s fine. As long as you tell others that you did that. I like to leave some alternate tag in their place (same for branches) with “-this-moved” at the end of it. After a month or whatever your activity level is, I delete those too.