attach: check for upbound-system/mxp-config ConfigMap and check account

[sttts]

Without matching account, the attached space rejects every request with 401. This PR checks the account before attaching.