Release v22.154.3

Changed

• Tenant membership hooks (ITenantMembership) are now resolved once per request or observable-query subscription and reused only within it, instead of on every tenant read. The membership check itself still runs on every read, and applications without a hook are unaffected. (#3598)