GetWorkflowVersionById only filtered by version id, so a caller could read any
tenant's workflow version by passing its id as ?version= on their own
workflow. Filter by tenant in the query and reject versions that do not
belong to the workflow in the path.