[FIX] hr_attendance: multi-company rule

Before this commit, a user with attendance administrator rights can see
the attendances of all users of all companies and not only the companies
he is allowed.

Now, the administrator will only see the attendances of the users of the
companies he is allowed.

opw-2263577

closes odoo/odoo#52339

Signed-off-by: Nicolas Lempereur (nle) <nle@odoo.com>

addons/hr_attendance/security/hr_attendance_security.xml

@@ -42,7 +42,14 @@
         <field name="comment">The user will have to enter his PIN to check in and out manually at the company screen.</field>
     </record>
 
-    <data noupdate="1">   
+    <data noupdate="1">
+
+        <record id="hr_attendance_rule_employee_company" model="ir.rule">
+            <field name="name">Employee multi company rule</field>
+            <field name="model_id" ref="model_hr_attendance"/>
+            <field name="global" eval="True"/>
+            <field name="domain_force">['|',('employee_id.company_id','=',False),('employee_id.company_id', 'in', company_ids)]</field>
+        </record>
 
         <record id="hr_attendance_rule_attendance_manager" model="ir.rule">
             <field name="name">attendance officer: full access</field>