Fix issue where payments can get their credit cards disassociated from them.

This was initially discovered when integrating with the paper_trail gem, which
calls dup in an after_update to try to capture the changed state of the
object, however, this could happen elsewhere and it is good to be
defensive here.

Fixes #4512
Pass source attributes to force validation on spec
check show deleted when searching for deleted products
default show deleted to fault and carry it's state over

Fixes #4509
Account for 1.3 upgrade when warning about migrations

Fixes #4518