Fix missing policy enforcement in CFN API

Currently the CreateStack and UpdateStack actions aren't correctly
enforcing the policy, so add calls to _enforce which fixes that,
and rework the test to illustrate the issue.

Change-Id: Ia5c2e65512ab9d1c163171f8617c081ab96745e5
Closes-Bug: #1256049
Add validation for an existence of a resource type

Validation of resource type existence was missing.
The patch adds validation checks that in the template the resource
type is set and is not an empty string.

Change-Id: I171644010ec868e8acc4c29556889256e8bf51b6
Closes-Bug: #1257243
Deny API requests where context doesn't match path

We shouldn't overwrite the context tenant_id (which comes from the
scope of the auth_token) with that from the path, instead raise a
HTTPForbidden exception if the path-provided tenant_id doesn't match
the context.

Change-Id: Ib6fb9881103312f7492081a20178f12309f35d81
Closes-Bug: #1256983
Merge "Fix missing policy enforcement in CFN API"
Merge "Deny API requests where context doesn't match path"
Merge "Add validation for an existence of a resource type"