Clearer API for bulk tenant unassignment

[byewokko]

To unassign tenant, use "UNASSIGN-TENANT" string, instead of empty array:

Example request body

{
  "credential_ids": [
    "mongodb:default:abc123def456",
    "htpasswd:local:zdenek"
  ],
  "tenants": {
    "*": [
      "*/global-editor"
    ],
    "acme-corp": [
      "acme-corp/user",
      "acme-corp/supervisor"
    ],
    "my-eshop": "UNASSIGN-TENANT",
  }
}

The call should revoke users mongodb:default:abc123def456 and htpasswd:local:zdenek access to the tenant my-eshop and unassign roles acme-corp/supervisor, acme-corp/user and */global-editor from them.