Role revocation depends on a live plan lookup, so users can keep paid roles after expiry or cancellation

Problem/Motivation

Role revocation in SubscriptionEntity::updateUserRoles() and preDelete() resolves which roles to remove by calling getPlan() at revocation time. If that lookup fails, no roles are removed and the user retains paid access indefinitely. The code acknowledges this: updateUserRoles() contains the comment "There's a bug here. If a plan is deleted, then an expiring subscription will fail to remove the corresponding user roles."

Lookup failure is not exotic. It happens when the plan entity was deleted locally (including by plan sync removing plans that no longer exist upstream), when the remote plan was renamed so plan_id no longer matches, or when #3616776: SubscriptionEntity::getPlan() ignores connector_plugin_id, allowing cross-connector plan_id collisions's cross-connector collision resolves to a different plan (which removes the wrong roles, equally bad). The same live-lookup pattern exists in subscription_manager_user_presave(), which rebuilds required roles from each active subscription's plan.

Net effect: access granted by a paid subscription can outlive the subscription. For sites selling access, this is revenue-relevant broken access control. (Filed in the public queue per policy, as the module has no stable release.)

Steps to reproduce

1. Create a plan granting a role; subscribe a user (role granted).
2. Delete the plan entity (or change its plan_id).
3. Let the subscription expire via cron, or set status to 0 and save.
4. updateUserRoles() logs "Could not find local plan matching remote plan id" and returns; the user keeps the role permanently.

Proposed resolution

• Add a granted_roles multi-value string base field to the subscription entity. Write it whenever roles are granted (in addRoles()), recording exactly what this subscription conferred.
• Revoke from the snapshot, not from getPlan(): updateUserRoles() (deactivation path) and preDelete() remove the snapshotted roles. Keep the plan lookup only as a fallback for pre-existing rows with an empty snapshot.
• Update subscription_manager_user_presave() to compute required roles as the union of snapshots of the user's other active subscriptions, with plan-lookup fallback, so its re-add logic can't resurrect roles from a wrong plan match.
• Update hook: install the field and backfill snapshots from current plan lookups where they still resolve.

Remaining tasks

Patch; kernel tests for the reproduce case above, for deletion with a missing plan, and for the presave union logic; change record for the new field.

User interface changes

None.

API changes

None; internal role-handling behavior only.

Data model changes

New granted_roles base field on the subscription entity, installed via update hook.