Grant a provider only the consumers bound to it (hq issue 274)

grantsFor granted every consumer a pair credential from the provider was
ever made for, so a consumer pinned back to its own store was still asked
of the store it left, which then never retired it. A credential whose
consumer's resolution binds it elsewhere is now withdrawn like one nobody
asks for, kept on record for the login the provider keeps, and said on
plan and push.

cmd/mesh-controller/identity_bound_test.go

@@ -96,7 +96,7 @@ func TestAnOverflowingConsumerNeverRefusesItsProvidersMachine(t *testing.T) {
 	if len(declared.withheld) != 1 || declared.withheld[0].Identity != "mesh_laptop_photoalbum" {
 		t.Fatalf("the overflowing consumer is not the one withheld: %+v", declared.withheld)
 	}
-	grants, _, err := grantsFor(ctx, open, "anchor")
+	grants, _, _, err := grantsFor(ctx, open, "anchor")
 	if err != nil {
 		t.Fatal(err)
 	}