Tenant is not mapped to the user in flowable-ui when Keycloak is enabled

**Is your feature request related to a problem? Please describe.**

- When using Flowable UI with Keycloak integration, the tenant Id variable is always returned as null.
- We are unable to sort business processes by tenant so any user will see all processes/apps for all tenants.
- When setting tenantId a request is issued to a URL like this `http://{HOST}flowable-ui/idm-app/rest/admin/users/{USER}` but this exception is raised:

> org.flowable.common.engine.api.FlowableException: Keycloak identity service doesn't support saving an user

**Describe the solution you'd like**

Tenant Id might be mapped in the token as a specific group or claim or maybe both depending on a configuration.
What is the best way to implement such a feature? I might be able to help if we agree on the best way to do it.

**Describe alternatives you've considered**

We can avoid setting tenant ID from flowable-ui as it might be in progress. However, it's preferable to have a workaround to map tenant-id from keycloak.

**Additional context**
Flowable UI using Keycloak based authentication.

Inizia dal percorso di autenticazione Keycloak di Flowable UI e dalla richiesta REST mostrata per /idm-app/rest/admin/users/{USER}; verifica come viene ottenuto tenantId e perché il salvataggio di un utente viene rifiutato. Il lavoro è completato quando esiste una mappatura concordata dai claims o dai gruppi Keycloak al tenantId dell’utente e il filtraggio di processi e app basato sul tenant funziona senza questa operazione di salvataggio non supportata.

Scritto dal modello di indicizzazione a partire dal testo della issue.