substrate gets tenant-id from config, not credentials

Juju 2 rejects unexpected values from credentials.yaml, including tenant-id for Azure-arm.
environments.yaml for azure-arm contains tenant-id.

substrates.py requires tenant-id, so it gets it from JujuData._config.

Ideally, we would change substrates.py to not require tenant-id (if there's a way to do that and still support Azure storage). Failing that, we could provide tenant-id through an alternative mechanism such as an environment variable, commandline arg, or additional credentials file.