[Master,11,10,9,8][Security] model.transient : read_group() and read() have access of all records of all user

[fmdl]

Impacted versions:
master, 11, 10, 9, 8

Steps to reproduce:

• use SQL code to generate lines on transient model, with create_uid = 1.
• connect with an other uid
• go on the tree view of this model
• you see no record
• BUT group by and pivot works

Current behavior:
any other user can see with pivot or group by some information

Expected behavior:
any other user cannot see data

Start of solution :
It seems the function read_group have no filter about the create_uid during the query for the transient model.

Video/Screenshot link (optional):

cc : @sylvain-garancher

#20328

[Yenthe666]

Hmm perhaps something for you to check @odony?