1110843: Lookup correct upstream cert from source stack.

When thumbslug fetches the upstream cert for an entitlement from a stack
derived sub-pool, we'll return the eldest entitlement in the host's stack that
is currently active.

Replace barren entitlement resource test with some actual tests for this
functionality.