[FIX] mrp: better selection of bom

When searching for a bom based on a product.product, the method used to return any bom linked to the template (so searching for bom for variant A could return bom for variant B if both share the same product.template).
This will allow to return bom not linked to a variant without returning the one of another variant (opw 609358)
[IMP] base/res_users: improve reading/writing of reified group fields

- simplify the code by removing unused cases
- do not modify input argument 'value' of create/write
- do not call BaseModel.read() with reified group fields (this causes warnings)
[IMP] Do not create FK when destination model is _auto=False

It is not useful to try to create foreign keys when the destination model is
a PostgreSQL view for example.
We already do this kind of verifications but ir.actions and transient models
but did not for _auto.
[FIX] account: prevent crash onchange company_id

(rebase of #1534)
[IMP] models: turn _patch_method() and _revert_method() into class methods

This makes the patching mechanism more flexible, and enables patching BaseModel,
for instance. This should fix #1501.
[FIX] web_kanban: parent can be undefined in some cases

opw-611106, when clicking quickly Sales > Opportunities than Sales > Leads.
[FIX] purchase: now allow 'can be purchased' to be checked even if not variant

Before, the field purchase_ok was set as readonly on the product form if the product wasn't a variant, to avoid users to set all the products variants associated to the product template to be set as purchase able in one action.

We now consider that this can be done by the end user
[MERGE] forward port of branch saas-5 up to 7d7f6fe
[FIX] hr_contract: count the number of contracts of an employee as superuser_id as this field is required in the form view. However no data is displayed, and no data about the contracts are leaked, so no security holes.
[FIX] fields: convert_to_cache() on *2many fields must take record's current value

The existing code was buggy when writing on *2many fields with a list of
commands: the value was converted for the cache, but taking an empty recordset
as the current value of the field.