Ensure timesheet_works return only employee's company works

It can not rely on the record rule to return the right list of works because
user from the admin group does not have the record rule.

issue6505
review40361002

routes.py

@@ -33,7 +33,9 @@ def timesheet_works(request, pool, employee):
     employee = Employee(employee)
     with Transaction().set_context(
             company=employee.company.id, employee=employee.id):
-        works = Work.search([])
+        works = Work.search([
+                ('company', '=', employee.company.id),
+                ])
     return [{
             'id': w.id,
             'name': w.rec_name,