https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/networking/configure-interfaces/virtual-wire-interfaces/vlan-tagged-traffic Virtual wire interfaces by default allow all untagged traffic. You can, however, use a virtual wire to connect two interfaces and configure either interface to block or allow traffic based on the virtual LAN (VLAN) tags. VLAN tag 0 indicates untagged traffic.
You can also create multiple subinterfaces, add them into different zones, and then classify traffic according to a VLAN tag or a combination of a VLAN tag with IP classifiers (address, range, or subnet) to apply granular policy control for specific VLAN tags or for VLAN tags from a specific source IP address, range, or subnet.

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/panorama-web-interface/panorama-commit-operations.html

According to the Palo Alto Networks documentation1, application override is where the firewall is configured to override the normal application identification (App-ID) of specific traffic passing through the firewall. To implement application override, the following items must be configured:
Custom app: This is a user-defined application that is used to identify the traffic that needs to be overridden. It is recommended to create a custom app for the application override policy, rather than using a predefined app that may have different default ports and threat inspection capabilities2.
Security policy rule: This is a rule that allows the traffic that matches the custom app through the firewall. The security policy rule must use the custom app as the application filter and specify the source and destination zones, addresses, and users as needed2.
Application override policy rule: This is a rule that defines the criteria for overriding the App-ID of the traffic. The application override policy rule must use the custom app as the application filter and specify the source and destination zones, addresses, ports, and protocols as needed2.
The other options are not required or relevant for implementing application override:
Decryption policy rule: This is a rule that defines the criteria for decrypting encrypted traffic. It is not related to application override, although decryption may be needed to identify some applications that use encryption.
Application filter: This is an object that groups applications based on various criteria, such as category, subcategory, technology, or risk. It is not an item that must be configured for application override, although it can be used as a reference in security policy rules or custom apps.

According to the Palo Alto Networks Compatibility Matrix1, the three platforms that support PAN-OS 10.2 are:
PA-800 Series2
PA-2202
PA-3400 Series2
The PA-5000 Series and PA-500 do not support PAN-OS 10.22.
To upgrade devices to PAN-OS 10.2 using Panorama, you need to determine the upgrade path3, upgrade Panorama itself4, and then upgrade the firewalls using Panorama5.