Add getTenantGraph

[heyitsaamir]

• The bot's AAD app is housed in whatever tenant the user created it in, but when it acquires a token to call SMBA it typically acquires a token against the botframework service tenant (this is a special tenant). The exception to this is bots that have been configured as single tenant apps, where they will only be able to acquire a token against the tenant they were original provisioned in
• We can get token for the bot from this special tenant. Once we get that, only SMBA or bot-framework understand this special tenant. So when we make calls to https://token.botframework.com/api or other SMBA specific endpoints, these services can verify the bot from the special tenant, and still route messages to the actual tenant.
• This special tenant has basically no resources. No Teams, etc. So if you ever want to call any resources, like graph, then you MUST use tenant specific tokens.