tenant: unexport EnforceTenant (#957)
The only place this was called outside of the tenant package was for
deciding if we should call tenant.Log. However, we can inline that check
and both simplify the tenant exported API as well as how you call
tenant.Log.
Test Plan: CI