Compliance-service endpoints need to guard against requests with no projects data

[phiggins]

Related to chef/a2#5116

As discussed in the iamv2 meeting yesterday (4/11), for the initial implementation of projects filtering for compliance-service we are ignoring the case where incoming requests have no project data attached. By design all requests should include projects data, so this is guarding at the seams between services that this assumption is being maintained.

Being lenient to non-compliant requests is useful in the short term to allow existing code that has no knowledge of projects to continue working, but eventually we will want to be strict in how that is handled.

[lancewf]

This needs to be done for the config-mgmt-service and the node-manager also.

[vjeffrey]

we cannot do this work until everyone is on iamv2. backing out of the sprint/board until then.