Implement new token payload to prevent escape from bound_xxx

[gtema]

In the mapping we can have bound_project_id, bound_role_ids. We need to put that info into the token payload to prevent user from escaping this with rescoping