Bind each token to its issuer, scopes, and tenant

Tokens now carry issuer namespace, scopes, and tenant in signed claims; callers need no validator changes for new tokens.