SubscriptionEntity::getPlan() ignores connector_plugin_id, allowing cross-connector plan_id collisions

Problem/Motivation

SubscriptionEntity::getPlan() loads the plan with loadByProperties(['plan_id' => $this->getPlanId()]) and returns the first result. The plan_id field holds the connector's remote identifier, and remote identifiers from different billing services live in different namespaces: nothing prevents two connectors from each having a plan whose remote ID is, say, pro-monthly.

When that happens, getPlan() can return the other connector's plan. Because plan lookups feed role grants (subscription_manager_user_presave()) and the membership portal display, a collision silently grants the wrong roles or displays the wrong plan. The subscription entity already knows its connector; the lookup just doesn't use it.

Steps to reproduce

1. Create two plans with the same plan_id value but different connector_plugin_id values and different roles.
2. Create a subscription referencing the second connector.
3. Call getPlan() on it; depending on entity IDs, the first connector's plan is returned and its roles are granted.

Proposed resolution

• Include connector_plugin_id in the getPlan() lookup, falling back to the current plan_id-only lookup when the subscription predates the field being populated (or when the stored connector has been uninstalled), to avoid breaking existing data.
• Audit other plan_id-only lookups for the same pattern (e.g. userIsSubscribedToPlan() builds its query from plan_id and user_id).

Remaining tasks

Patch, kernel test constructing the collision above and asserting the correct plan is returned, decide whether the fallback deserves a deprecation notice.

User interface changes

None.

API changes

None; getPlan() keeps its signature and return type.

Data model changes

None.