[FIX] portal_sale: security rules matching the one of public user

The portal users had no access to the attributes objects (while the public user does) and was not allowed to render the shop page.
Fixes #1961