Today, OpMsgRequest::fromDBAndBody build request without ValidatedTenancyScope. It totally depends on the "$tenant" field and "expectPrefix" field in the input `body` to indicate the tenant information and tenant protocol. 

In this task, we should figure out a way to ensure its call sites build requests with ValiatedTenancyScope. So that, we only support tenant information and tenant protocol with security token in ValidatedTenancyScope.