1110843: Lookup correct upstream cert from source stack.

Sub-pools originating from a stack have no subscription ID because they
technically could be from multiple subscriptions, causing Candlepin to return
no upstream certificate when thumbslug requested one to proxy a guests
entitlement.

When thumbslug fetches the upstream cert for an entitlement from a stack
derived sub-pool, we'll return the eldest entitlement in the host's stack that
is currently active.

Replace barren entitlement resource test with some actual tests for this
functionality.

Spec test author: William Poteat <wpoteat@redhat.com>
Merge pull request #612 from candlepin/wottop/derived-product-upstream

Entitlements from derived product pool not able to get upstream