fix: api key security risk (#1712)

add tenant id to the header when sent in the request
otherwise server treats this as default tenant

Author: nikhilsinhaparseable

src/handlers/http/middleware.rs

@@ -186,6 +186,10 @@ where
                         permissions,
                         &user.tenant,
                     );
+                    req.headers_mut().insert(
+                        HeaderName::from_static(TENANT_ID),
+                        HeaderValue::from_str(tenant).unwrap(),
+                    );
                     req.extensions_mut().insert(session_key);
                     Some(session_id)
                 }