receive: validate grpc remote write tenant

[officialasishkumar]

• I added CHANGELOG entry for this change.
• Change is not relevant to the end user.

Changes

Fixes #8812.

• Validate the tenant carried by gRPC RemoteWrite before the ingestor-only fast path or router fanout uses it.
• Use the configured/default tenant for empty gRPC tenant values, matching HTTP receive behavior when no tenant header is supplied.
• Return InvalidArgument for invalid tenant values instead of using them to select or create TSDB directories.

Verification

• go test -tags slicelabels ./pkg/receive -run 'TestReceiveGRPCTenantValidation|TestTenantFromWriteRequest|TestReceiveTenantValidation|TestHandlerSplitTenantLabelLocalWrite|TestReceiveQuorumHashmod|TestReceiveQuorumKetama' -count=1

[GiedriusS]

Could you please refactor so the same GetTenantFromHTTP could be reused? I think we can just remove *http.Request there and pass some generic types.

[officialasishkumar]

Done in 0a7cb2f: GetTenantFromHTTP now delegates to generic metadata extraction shared with the gRPC write path. Focused tenancy, receive, and query compile checks passed.

[officialasishkumar]

Refactored the gRPC tenant validation to reuse GetTenantFromHTTP through a generic header getter in 00b3c95.