[FIX] portal_sale: remove un-necessary access rights, improve rules

Portal access rights need to be associated with
security rules, or not granted at all, as soon
as they grant access to non-trivial data.
[FIX] portal_sale: remove more access rights, add pricelist access

Pricelist access is necessary for being able to read
the unit price of sale order lines, and does not
pose major security risks, as it does not permit
reading the actual pricelist definition.