Ensure that in v2 auth tenant_id matches trust

Previously if a trustee requests a trust scoped token for a project that
is different to the one in the trust, however the trustor has the
appropriate roles then a token would be issued.

Ensure that the trust that was given matches the project that was
specified in the scope.

Conflicts:
	keystone/token/controllers.py

Closes-Bug: #1331912
Change-Id: I00ad783bcb93cea9e5622965f81b91c80f4570cc
(cherry picked from commit 96d9bcf230a74d6122a2b14e00ef10915c8f76e3)