fix: adds additional check for dangling enrollments

[sandsinh]

Filter dangling enrollments in getAllEnrollment

Summary

Added validation to filter out dangling site enrollments - enrollments that reference sites belonging to a different organization than the entitlement.

Changes

• Fetches associated sites using batchGetByKeys after retrieving enrollments
• Filters out dangling enrollments where site's orgId doesn't match entitlement's orgId
• Logs warnings with details (enrollmentId, siteId, siteOrgId, expectedOrgId) for monitoring
• Also handles orphaned enrollments where the site no longer exists

Why

Dangling enrollments can occur when sites are moved between organizations but their enrollments aren't cleaned up. This fix ensures the API returns only valid enrollments, preventing issues downstream.

Please ensure your pull request adheres to the following guidelines:

• make sure to link the related issues in this description
• when merging / squashing, make sure the fixed issue references are visible in the commits, for easy compilation of release notes

Related Issues

Thanks for contributing!

[ravverma]

LGTM
leaving one change request

[github-actions]

This PR will trigger a patch release when merged.