`RestrictedStockManagement` does not restrict visible stock locations

We have the RestrictedStockManagement permission set class to restrict users with a given role (to which permissions are applied) to a sub-set of all the available stock locations.

However, it's not working as intended, and affected users can still see all active stock locations.

Solidus Version:
Tested on Solidus v3.2

To Reproduce

1. Generate the sandbox app
2. Add the following in config/initializers/spree.rb

  config.roles.assign_permissions :warehouse_admin, [
    'Spree::PermissionSets::RestrictedStockManagement'
  ]

3. Run bin/rails console
4. Execute the following:

warehouse_admin_role = Spree::Role.create(name: 'warehouse_admin')
user = Spree::User.create(email: 'foo@foo.com', password: 'foo', spree_roles: [warehouse_admin_role])
user.stock_locations << Spree::StockLocation.find(1)
ability = Spree::Ability.new(user)
Spree::StockLocation.accessible_by(ability).to_sql

Current behavior
The instructions above generate the following SQL statement:

"SELECT \"spree_stock_locations\".* FROM \"spree_stock_locations\" WHERE ((\"spree_stock_locations\".\"id\" = 1) OR (\"spree_stock_locations\".\"active\" = 1))"

Notice how the OR clause will effectively give the limitation by id without practical effects.

Expected behavior

"SELECT \"spree_stock_locations\".* FROM \"spree_stock_locations\" WHERE ((\"spree_stock_locations\".\"id\" = 1) AND (\"spree_stock_locations\".\"active\" = 1))"

AND should be used instead of OR

Additional context

Reported in https://solidusio.slack.com/archives/C0JBKDF35/p1669378692090879

Start with core/lib/spree/permission_sets/restricted_stock_management.rb and follow how Spree::Ability combines its stock-location rules for StockLocation.accessible_by. Reproduce the issue in the sandbox console using the warehouse_admin role and verify that the generated SQL uses AND so restricted locations remain limited to active records.