[FIX] payment: access rights limitation

Do not allow everybody to access account.transactions.
Restrict by default to readonly and even restrict the access with a record rule, give access to salesman.
[IMP] payment: simplify rev d99835e

The group public is defined in base so no need to add security rule in website_payment module (same as for portal)
[FIX] website_sale: retrieve transactions as superuser

Due to additional security rules, the transactions made as public user will have a new partner_id. The transaction needs to be retrieved as admin to be set in the context.
The operations in payment_get_status are made as superuser but the session_id is checked in the assert above to avoid url manipulation.
Forward port of branch saas-3 up to rev 2ee1843
[IMP] website_sale: do not show transaction on sale order

This object is quite technical and has not purpose to be displayed on a sale order.