Currently, a product's stockrecords are used to decide if a user is
allowed to edit a product or not. That doesn't work for parent products,
because they don't have stockrecords. So it's not possible to decide
whether a user is allowed to edit a parent product (and e.g. create
children) for it.

As far as I'm aware, this is not a regression of the
permission-dashboard; I don't think it ever worked. It just hasn't been
spotted because nobody needed it.

This commit also adds some tests to ensure this is enforced.

Done as it became apparent in #968 that further clarification is needed.

We currently mention it in internals/sandbox.rst. I've added a note to
the dashboard app (ref/apps/dashboard.rst), the sandbox/urls.py and
expanded on the feature explanation on index.rst.

Fixes #816

Some of them are rather basic, but it's a start.