[FIX] analytic,sale: confirm SO with "expense" product

Before this commit, when a salesman user without any access in other
apps (just has the `sales_team.group_sale_salesman` group) creates
an SO and adds a SOL for a product with `expense_policy='sales_price'`
and then confirm the SO, he will got a traceback because he does not
have access to `analytic.account.line` model. The reason is because
an analytic account has to be generated for the SO since there is an
expense product in its SOLs and so during the generated of analytic
account a check is triggered to be sure the company set on that
analytic account is correct.

This commit adds a sudo before calling the search method in
`analytic.account.line` model to do the check without checking
the access right since the user does not really want to read the
analytic account line.

Steps to reproduce
==================
1. Log in as Salesman user (without other access)
2. Create a product and the expense policy to Sales price.
3. Create a SO and add a SOL with that product
4. Confirm the SO

Expected Behavior
=================
The SO should be confirmed without any issue (and an analytic account
should set on that SO)

Actual Behavior
===============
Traceback is occured because the user cannot access to
`analytic.account.line` model.

Follow-up task-3256865

closes odoo/odoo#155238

Signed-off-by: Xavier Bol (xbo) <xbo@odoo.com>

addons/analytic/models/analytic_account.py

@@ -95,7 +95,7 @@ class AccountAnalyticAccount(models.Model):
     @api.constrains('company_id')
     def _check_company_consistency(self):
         for company, accounts in groupby(self, lambda account: account.company_id):
-            if company and self.env['account.analytic.line'].search([
+            if company and self.env['account.analytic.line'].sudo().search([
                 ('auto_account_id', 'in', [account.id for account in accounts]),
                 '!', ('company_id', 'child_of', company.id),
             ], limit=1):

addons/sale/tests/test_sale_order.py

@@ -446,6 +446,26 @@ class TestSaleOrder(SaleCommon):
         self.assertFalse(public_user.has_group('sale.group_auto_done_setting'))
         self.assertTrue(self.sale_order.locked)
 
+    def test_generate_account_analytic_when_confirm_so(self):
+        """ Test generate account analytic when SO with expense product is confirmed """
+        restaurant_expenses_product = self.env['product.product'].create({
+            'name': 'Restaurant Expenses',
+            'type': 'service',
+            'expense_policy': 'sales_price',
+            'list_price': 14.0,
+            'standard_price': 10.0,
+        })
+        sale_order = self.env['sale.order'].with_user(self.sale_user).create({
+            'partner_id': self.partner.id,
+            'order_line': [Command.create({
+                'product_id': restaurant_expenses_product.id,
+                'product_uom_qty': 1,
+            })],
+        })
+        self.assertFalse(sale_order.analytic_account_id)
+        sale_order.action_confirm()
+        self.assertTrue(sale_order.analytic_account_id, "An analytic account should be generated")
+
 
 @tagged('post_install', '-at_install')
 class TestSaleOrderInvoicing(AccountTestInvoicingCommon, SaleCommon):