EventSubscriptionManager#findConditionalStartEventSubscriptionByTenantId and EventSubscriptionManager#findConditionalStartEventSubscription must return only subscribtions that belong to the process definition the user has READ permission for (+ tenantId check if needed).

So that

• the user can't receive error, that he does not have permission to start process instance for those process definition, that he can't even read.