[FW][FIX] project: add same rules than project.update for milestones

Before this commit, the internal user can access to all milestones
created in Project app even if he has no access to the project related.

This commit adds the rules for the project.milestone to filter the
records when the user is not a Project Manager.

closes odoo/odoo#88819

X-original-commit: 6438d8e690229b27ab08ecac436e54a85096eb0f
Forward-port-of: #88546
Forward-port-of: #88509
Signed-off-by: Yannick Tivisse (yti) <yti@odoo.com>
Signed-off-by: Xavier <xbo@odoo.com>

addons/project/security/project_security.xml

@@ -275,5 +275,30 @@
         <field name="groups" eval="[(4,ref('project.group_project_user'))]"/>
     </record>
 
+    <record model="ir.rule" id="milestone_comp_rule">
+        <field name="name">Project/Milestone: multi-company</field>
+        <field name="model_id" ref="model_project_milestone"/>
+        <field name="domain_force">[('project_id.company_id', 'in', company_ids)]</field>
+    </record>
+
+    <record model="ir.rule" id="milestone_visibility_rule">
+        <field name="name">Project/Milestone: employees: follow required for follower-only projects</field>
+        <field name="model_id" ref="model_project_milestone"/>
+        <field name="domain_force">[
+        '|',
+            ('project_id.privacy_visibility', '!=', 'followers'),
+            '|',
+                ('project_id.message_partner_ids', 'in', [user.partner_id.id]),
+                ('project_id.user_id', '=', user.id),
+        ]</field>
+        <field name="groups" eval="[(4, ref('base.group_user'))]"/>
+    </record>
+
+    <record id="milestone_visibility_project_admin" model="ir.rule">
+        <field name="name">Project/Milestone: Project manager can see all project milestones</field>
+        <field name="model_id" ref="project.model_project_milestone"/>
+        <field name="domain_force">[(1, '=', 1)]</field>
+        <field name="groups" eval="[(4, ref('project.group_project_manager'))]"/>
+    </record>
 </data>
 </odoo>