[IMP] add read access to all users for product.pricelist.type

In new API, selection field value is checked (against the selection's possible
values) at both read and write. For pricelist.type this requires read access
to product.pricelist.type.
[ADD] demonstrate broken handling of rules access denial in new API
[FIX] only prefetch other cached records with read field uncached during _read_from_database

If expansion of the recordset is done during _prefetch_field, if one of the
prefetches (not the base record(s) but one of those selected by
BaseModel._in_cache_without) can't be read by the current user (due to an
access rule or for field reading reasons, or whatever) the whole read is
failed, even if the record which was specifically asked for could be read on
its own.

By only expanding the read set in _read_from_database, the cache is correctly
set but read() and _prefetch_field() only check the records explicitly asked
for for AccessDenied, prefetched records will only be asked if they are ever
accessed.

fixes #1013
[FIX] filtering out of records which shouldn't be fetched/prefetched

A todo would only filter out records selectioned by the same field's caching,
it should filter out on the whole prefetching selection or an other field
could/would just add it back to the set of records to fetch (and lead to Bad
Things).

Note: this probably deserves a test somehow, but I'm not quite sure how the
todos thing works so...
[REM] cache setting in _prefetch_field
[FIX] calendar: invalidate cache to avoid (pre)fetching invalid virtual IDs

Because the new API basically browses everything, the virtual IDs used by
calendar.event are added to the cache and prefetching tries to get them from
the database resulting in conversion errors. These ids have to be forcibly
evicted to avoid the error.
Merge pull request #1076 from xmo-odoo/8.0-shop-fix-xmo

Fix access rights issues in new API for the shop home page