Clarify the expected payload for REST on CancelTaskRequest

[ehsavoie]

#1484 has introduced a metadata field for task cancellation. It is not clear now how the taskId and tenant should be provided to the REST endpoint:

• since it is a POST we should have them as part of the JSON payload
• only the metadata should be in the POST payload and the tenant and taskId should be retrieved from the URL

[amye]

Is this a blocker for 1.0?