[19.0][ADD] portal_address_parent_protection

[MarcGForgeFlow]

A portal user who is a child contact of a company can rename that company and overwrite its address from the frontend address forms. This module closes the three paths that allow it.

The company gets renamed because _create_or_update_address() assigns parent_company.name = company_name, and _validate_address_values() drops company_name only when the edited address is not the current customer's own record. A contact therefore renames its parent company through its own address form.

The company record itself becomes editable because _can_be_edited_by_current_customer() compares the edited record against _get_current_partner(), which website_sale overrides to return the customer of the current cart. When something sets the cart customer to the parent company - OCA's website_sale_partner_sale_contact does exactly that - core sees self == current_partner and grants the portal user full edit rights on the company during checkout: name, email, phone and address, in a single submission. This module anchors the check on the partner of the logged in user instead. Public users are left to the core behaviour, since their own partner is the public one while the cart may legitimately point to the address they just created.

The company address gets overwritten because a contact of type contact shares its parent's address, so _fields_sync() propagates any address change up to the parent (res.partner, section "To UPSTREAM"). A portal contact saving their personal address replaces the address of the whole company. This is now skipped when the write comes from a portal user. Writes including parent_id are left untouched, as core is then expected to initialise the address of the company the contact is being attached to.

To reproduce, with website_sale and website_sale_partner_sale_contact installed:

1. Log in to the portal as a child contact of a company.
2. Add a product to the cart. The order customer becomes the parent company.
3. Go to the address step of the checkout: the company address is editable, and saving it rewrites the company's name, email, phone and address.
4. Separately, in /my/account, saving your own street also changes the company address.

Internal users keep the core behaviour in both cases. See the ROADMAP for the website_event_sale limitation.