Provide capped stock quantity instead of exact one and restrict the costPrice field productVariant

[NyanKiyoshi]

Closes #4724.

Screenshots

Pull Request Checklist

1. Privileged views and APIs are guarded by proper permission checks.
2. All visible strings are translated with proper context.
3. All data-formatting is locale-aware (dates, numbers, and so on).
4. Database queries are optimized and the number of queries is constant.
5. Database migration files are up to date.
6. The changes are tested.
7. GraphQL schema and type definitions are up to date.
8. Changes are mentioned in the changelog.

[django-queries]

Here is the report for f9b26ee (NyanKiyoshi/saleor @ fix/variants/stock-permissions)
Base comparison is 5592ca3.

**Found 1 differences!** (click me)

# api.benchmark checkout
  test name                                  	left count 	right count	duplicate count
  -------------------------------------------	-----------	-----------	---------------
  add billing address to checkout            	         34	         34	             20
  add shipping to checkout                   	          7	          7	              0
  checkout payment charge                    	         14	         14	              0
  complete checkout                          	          6	          6	              0
  create checkout                            	         48	         48	             24

# api.benchmark homepage
  test name                                  	left count 	right count	duplicate count
  -------------------------------------------	-----------	-----------	---------------
  retrieve main menu                         	          5	          5	              0
  retrieve product list                      	          4	          4	              0
  retrieve secondary menu                    	          5	          5	              0
  retrieve shop                              	          2	          2	              0

# api.benchmark product
  test name                                  	left count 	right count	duplicate count
  -------------------------------------------	-----------	-----------	---------------
  product details                            	         15	         15	              3
  retrieve product attributes                	         13	         13	              2

# api.benchmark variant
  test name                                  	left count 	right count	duplicate count
  -------------------------------------------	-----------	-----------	---------------
+ retrieve variant list                      	         18	         15	              6

# api product sorting attributes
  test name                                  	left count 	right count	duplicate count
  -------------------------------------------	-----------	-----------	---------------
  sort product not having attribute data     	         21	         21	              0

[codecov]

Codecov Report

Merging #4753 into master will increase coverage by 0.01%.
The diff coverage is 100%.

@@            Coverage Diff             @@
##           master    #4753      +/-   ##
==========================================
+ Coverage   91.23%   91.25%   +0.01%     
==========================================
  Files         344      344              
  Lines       20616    20623       +7     
  Branches     1956     1956              
==========================================
+ Hits        18810    18819       +9     
+ Misses       1268     1266       -2     
  Partials      538      538

Impacted Files	Coverage Δ
saleor/graphql/product/types/products.py	92.17% <100%> (+0.63%)	⬆️
saleor/product/models.py	93.77% <100%> (ø)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 5592ca3...f9b26ee. Read the comment docs.

[maarcingebala]

I think there should be some way to determine available quantity in the public API. We spoke with @patrys and came up with an idea to:

• have the stockQuantity restricted for admins and if they have rights to return the total amount of items in stock
• extend the pricing field for variants with quantity field that would be public and would return number of items, but not greater than settings.MAX_CHECKOUT_LINE_QUANTITY value

Also, I was checking if we could use the isAvailable field for variants and found out that underlying ProductVariant.is_available function is broken. Instead of checking that a particular variant is in stock, it uses self.product.is_available, which will always return True if at least one variant is in stock.