Enforce guessing field value without access
For now, user can make search on any field with or without nested notation.
This may allow user who does not have read access to some model or field to try to guess some values by performing crafted queries.
For example, if the user does not have access to the employee cost_price, he can make search like this: [('id', '=', employee_id), ('cost_price', '=', x)] and varying x until having a result.
So I propose that ModelStorage.search check the read access to the fields used in domain. It should test direct field but also nested one. This should be done only if _check_access is True.