[FIX] website_sale: hide unpublished product to portal subcontractor

Steps to reproduce:

- Activate Subcontracting in the settings.
- Create a storable product
- Create a BOM of type "subcontracting" where the subcontractor is a
  Portal user (e.g. Joel Willis) for that product.
- Log out and connect as your portal user.
- Go to the website shop and search your product.

Expected behavior:

The portal user should only be able to see the published products.

Current behavior:

The portal user sees unpublished products for which he is subcontractor.

Cause of the issue:

The commit 99b56ec has introduced a subcontracting portal. In order for
portal users to be able to interact with product templates, the
following rule was added to the "base.group_portal":
https://github.com/odoo/odoo/blame/f0a0d596ab716c96de38a5c0f837da2924338d7b/addons/mrp_subcontracting/security/mrp_subcontracting_security.xml#L120-L131
When you go to the website shop, the records displayed in the shop will
be computed here:
https://github.com/odoo/odoo/blob/1c321cd1fe0aabd9cd92c13cd1eae604e5817ae0/addons/website_sale/controllers/main.py#L348
https://github.com/odoo/odoo/blob/f0a0d596ab716c96de38a5c0f837da2924338d7b/addons/website/models/mixins.py#L353-L357
However, during this call, the "ir.rule" added for portal users will be
added to the SQL query here:
https://github.com/odoo/odoo/blob/1c321cd1fe0aabd9cd92c13cd1eae604e5817ae0/odoo/models.py#L4682
As such, products (enven if unpublished) for which the portal user is a
subcontractor will be fetched and displayed in the shop.

Fix:

Since the "ir.rule" can not be changed only for flows involving the
`website_sale` application, we propose to make a change similar to
commit b1f6171 whose purpose is to hide unpublished products for non
internal users:
https://github.com/odoo/odoo/blob/1c321cd1fe0aabd9cd92c13cd1eae604e5817ae0/addons/website_sale/models/product_template.py#L105-L108

opw-3768845

closes odoo/odoo#160703

X-original-commit: d57db5b6a7ca4579145723139223cab3d8a7dd24
Signed-off-by: Valentin Chevalier <vcr@odoo.com>
Signed-off-by: Lancelot Semal (lase) <lase@odoo.com>

addons/website_sale/models/website.py

@@ -294,7 +294,10 @@ class Website(models.Model):
         return pricelist
 
     def sale_product_domain(self):
-        return expression.AND([self._product_domain(), self.get_current_website().website_domain()])
+        website_domain = self.get_current_website().website_domain()
+        if not self.env.user._is_internal():
+            website_domain = expression.AND([website_domain, [('is_published', '=', True)]])
+        return expression.AND([self._product_domain(), website_domain])
 
     def _product_domain(self):
         return [('sale_ok', '=', True)]