Fix access rights issues in new API for the shop home page

Two issues prevented public (non-logged) users from accessing the shop's home:

* behavior of selection field has changed and the field's value is checked against the selection on both read and write. Here access to the pricelist would read `pricelist.type` which would call `_pricelist_type_get` (to verify that the value being read is valid) which tries to access `product.pricelist.type`, requiring that public user has read access to that model
* the second issue was more annoying, when reading a field `a` on a record `A`, the system looks for all records in its cache with `a` not filled. This usefully batches requests when e.g. iterating over browse records. The problem in the new API is this expansion of the recordset is done by `_prefetch_field` which would call `read()` on the expanded record, and `read()` checks for all the records it tried to read to see if any of them had an access error.

  This meant if the expansion lead to an access denied for one of the prefetched records, the whole read would be in error *even if the original record was accessible*.

  By moving recordset expansion to `_read_from_database`, the cache is correctly filled (including with error values) but only the records explicitly read are checked for access error, those read due to recorset expansion are only checked if they're ever explicitly accessed.

This should fix #1013 
This computes the union of all records that can be read.
If a record is in env.todo for one field but not for another, it will be prefetched anyway.
That will screw up the recomputation of the first field...