1113202: Add derived content to distributors ent cert

For VDC subscriptions, the host entitlements have no
content. This is what's getting exported to a distributor
and stored as the upstream cert. When a guest eventually
goes to use an entitlement from it's derived VDC pool,
the upstream cert has no content on it, preventing the
guest from getting content it is entitled to.

This patch generates VDC certificates differently if being granted
to a distributor, and includes all content for both the parent and
the derived pools. This will be the upstream certificate that
gets used to access content

**Note**
Tried testing this is a unit test but got tangled up in mocks. It was a lot easier to test via spec. Let me know if you feel strong enough that it should be unit tested in the service adapter.
We assume if there's a derived product, there must be derived provided products in other places don't we? If so this looks good.