[BUG] Fix multi-tenancy

[shurwit]

Describe the bug
Currently the Groups BB receives a "Client ID" through a a header with every request and uses this to manage multi-tenancy. This does not match with the app_id and org_id multi-tenancy model introduced by the Core BB and is not enforceable or consistent.

Expected behavior
We should use the app_id and org_id claims from a user's token to handle multi-tenancy and associate all related data with the specified app/org and ensure that users only get access to data for that app/org. The client ID and all related data should be removed. We will need to apply a migration to associate all existing groups and related data with the Illinois app/org. The IDs for the app/org can be found in the existing GROUPS_APP_ID and GROUPS_ORG_ID env vars.

Note: We may want to consider allowing groups to span across apps in the same org, but they must remain isolated by org at all times as previously discussed here: rokwire/content-building-block#63 (comment). For now I think we should start by keeping groups associated with both an app and org, but we should make the app_id nullable and handle it appropriately so we can add this functionality in the future.

[roberlander2]

This will depend on #346.