[FIX] portal_sale: remove more access rights, add pricelist access

Pricelist access is necessary for being able to read
the unit price of sale order lines, and does not
pose major security risks, as it does not permit
reading the actual pricelist definition.