[FIX] stock: wrong security rule

rev[0] aimed to fix an intercompany reservation issue by allowing the
intercompany moves to be seen, however the new domain was too soft and
also allows the visibility of any moves going to a location without
company, for example now outgoing moves to customer from all companies
are visible.

We strengthen the domain to only allow intercompany moves, ie we add the
transit constraint in the domain.

We also fix the same issue for the move line model (see [1])

Now that this one is fixed, the next move is automatically reserved
during _action_done. This didn't work either, so we carefully sudo and
force_company on the destination move.

[0] 3c4bb080
[1] f9461c7096a65565a05136a4c6c42ddfa6881926
task-2157248

closes odoo/odoo#42270

X-original-commit: 9a237d1af79519665d0895a30c9ce55a1d835918
Signed-off-by: Simon Lejeune (sle) <sle@openerp.com>