Enforce groups presence for federated authn

Check whether all the groups issued by the RuleProcessor are present in
the backend. The request is rejected with an authentication error if no
groups are issued. If any of the issued groups are not found in the
backend, an unexpected error (500) is returned with a message explaining
which group was not found. Also, this policy is applied when an unscoped
token is being scoped.

Change-Id: I8b843fc567892289fba4c04b7e8b1dfd63d1e9ca
Closes-bug: #1290258
Merge "Enforce groups presence for federated authn"