New module sale_order_authorized_users

Let Admin (or any user in the `base.group_erp_manager` group) choose, for each sale order,
which users will be able to access and see it. Any other user won't be able to see it.
If no users are set, the sale order has normal permissions.
The field to set allowed users will be visibile only to admin, which makes it
possible to make the users unaware of this feature.

Things that could be improved:
 - Tests?
 - create security rule also for `sale_order_line` if it's not automatic.

It's not 100% secure at the moment, but probably good enough for "normal" users.
Using the named parameter is cleaner, so it ends up to:

```
    'allowed_users_ids': fields.many2many(
        'res.users',
        string='Allowed Users',
        groups='base.group_erp_manager'
    ),
```