Entitlements from derived product pool not able to get upstream

The subscritption id is not on the stacked pools that are created for derived products.
The entitlements for those pools do not allow Thumbslug use as the upstream
cert comes from the subscription.
@dgoodwin Good catch! Might be worth checking for expiry here as well.