[MERGE] base: remove read access to ir.ui.view

Only system and designer users can access `ir.ui.view` records.
An employee, portal or public user should not be able to read a view arch, while
ok in standard (all views are in the code anyway), one may want to integrate
confidential business logic in some views.
All operations on views must be done in `sudo` or use helpers like
`fields_view_get` or `_render`.

This PR is part of the long-term task id 8203 that plans to remove all access to
`ir.*` models

**Changes of ACL**:
- remove read for all on `ir.ui.view`
- remove read for all on `website.page` (uses `_inherits`)
- add read on `ir.ui.view` for website publisher (cf `read_template`)
(maintain all for system and designer)

**Changes of method**:
- `fields_view_get` uses `sudo`. Can only be called only if we have the read
  access on the linked model.
- `render*` becomes private `_render*` and uses `sudo`. Shouldn't be able to
  arbitraly render any template. A QWeb template is not linked to a model so
  can't apply the same ACL check as in `fields_view_get`.
- `read_templates` remains public but without `sudo`. It is called by the method
  `load` method (now private too) or by the web_editor module

**Changes of behaviour**
- the `groups_id` parameter may be used on a view to relax the access and allow
  a specific group to access its content (e.g. frontend assets for employees)

closes odoo/odoo#44993

Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>

0 files changed, 0 insertions, 0 deletions