Currently, a product's stockrecords are used to decide if a user is
allowed to edit a product or not. That doesn't work for parent products,
because they don't have stockrecords. So it's not possible to decide
whether a user is allowed to edit a parent product (and e.g. create
children) for it.

As far as I'm aware, this is not a regression of the
permission-dashboard; I don't think it ever worked. It just hasn't been
spotted because nobody needed it.

This commit also adds some tests to ensure this is enforced.