Bypassing ARM's Memory Tagging Extension with a Side-Channel Attack