Follow-ups to https://github.com/sourcegraph/sourcegraph/pull/63173 I'm running into while working on CORE-169:

1. Intersect permission-allowed subscriptions, instead of always overwriting. I think this is probably desired behaviour, to still allow filtering by subscriptions. If no subscriptions are explicitly listed, then the allowed subscriptions become the set of subscriptions to list.
   1. If a permissions filter is used and the resulting subscription set is empty, we fast-exit with empty result
2. If no subscription list is provided, list all subscriptions. This is safe because permission filter has special fast-path above
3. Fix "is archived" support

Test plan

Tests, and a manual check - with sg start dotcom, exchange for a token:

sg sams create-client-token \
        -sams https://accounts.sgdev.org \
        -s 'enterprise_portal::subscription::read' \
        -s 'enterprise_portal::codyaccess::read'

Query for subscriptions without filters:

curl --header "Content-Type: application/json" --header 'authorization: bearer sams_at_...' --data '{}' http://localhost:6081/enterpriseportal.subscriptions.v1.SubscriptionsService/ListEnterpriseSubscriptions | jq

All subscriptions I have locally get returned ✅