Rules API: Validate tenant rules

As mentioned by @squat  [here](https://github.com/observatorium/api/pull/191):

"Note: this is a distinct problem from ensuring that the rules written by
a tenant are guaranteed to only include data from that tenant.
Currently, the rules from a tenant can select data from any tenant. This
is a distinct problem and should absolutely be tackled in a follow up."
