Tenant migration donor shouldn't check abort token without checking instance token

When handling an error before a tenant migration has committed, a tenant migration donor assumes if the abort migration token has been cancelled then the migration was aborted. This token inherits from the instance's token which is cancelled on stepdown/shutdown so it will also be cancelled in those cases. To distinguish between failover and user initiated abort, the donor should also check the instance token when checking the abort token.