[FIX] account.invoice: payments can never be shown to portal users, but residual might be needed

The residual amount is typically needed to render the
online payment forms (payment acquirers).

Payments on the other hand rely on account.move.line,
something that portal users should never be allowed to read.
Removing the field from the view by setting a model-level
group permission ensures they will not see an error.