[FIX] hr_expense: prevent linking of expense with no perm

Previously, a user could link his own expenses to a expense sheet
of someone else.

This would not be allowed upon creation but was allowed when updating
the values of the expense.

This commit add a simple check at the beginning of the write()

closes odoo/odoo#120661

X-original-commit: 884510b1496e0a0eba7171f4ef4bb749856cb1bf
Signed-off-by: Vranckx Florian (flvr) <flvr@odoo.com>

addons/hr_expense/models/hr_expense.py

@@ -373,6 +373,8 @@ class HrExpense(models.Model):
                 raise UserError(_('You cannot delete a posted or approved expense.'))
 
     def write(self, vals):
+        if 'sheet_id' in vals:
+            self.env['hr.expense.sheet'].browse(vals['sheet_id']).check_access_rule('write')
         if 'tax_ids' in vals or 'analytic_distribution' in vals or 'account_id' in vals:
             if any(not expense.is_editable for expense in self):
                 raise UserError(_('You are not authorized to edit this expense report.'))