[FIX] hr_expense: prevent linking of expense with no perm

Previously, a user could link his own expenses to a expense sheet
of someone else.

This would not be allowed upon creation but was allowed when updating
the values of the expense.

This commit add a simple check at the beginning of the write()

closes odoo/odoo#120008

Signed-off-by: Vranckx Florian (flvr) <flvr@odoo.com>