[FIX] portal_holidays: restrict overtime hint to internal users in view

[nicomacr]

Problem

Every full upgrade (-u all) of a database with portal_holidays installed logs 4 Access Rights Inconsistency warnings on the hr.leave.allocation views:

• hr_holidays_attendance adds a div showing employee_overtime (restricted to base.group_user) to the allocation form.
• This module grants read access on that field to group_portal_backend_holiday in Python (field groups override).
• During -u all, the views of hr_holidays_attendance (module ~284 of ~750) are validated before portal_holidays (~381) is loaded into the registry. At that point the validator sees the element shown to the portal group (its ir.model.access rows are already in the DB) while the field is still only accessible to base.group_user — a Python group grant from a later module can never win that window.

This is why the earlier Python-side fix (ea602fd) silenced CI installs but not full upgrades: 18→19 migration runs reproduce the 4 warnings on every pass (verified on two consecutive upgrade builds).

Fix

Restrict the overtime hint element to base.group_user at the view level: view inheritance lives in the DB, so it holds during the whole upgrade, including the window before this module's Python is loaded. Portal backend holiday users no longer see the "Extra Hours Available" hint in their allocations; internal users are unaffected.

Test plan

• -u all (double pass) over a migrated database with portal_holidays installed: no Access Rights Inconsistency warnings referencing employee_overtime (previously 4).
• As an internal user, the "Extra Hours Available" hint still shows on overtime-deductible allocations.
• As a portal backend holiday user, "My Allocations" opens and the form renders without the hint.

Internal task: https://www.adhoc.inc/odoo/project.task/69634

[roboadhoc]

[nicomacr]

Closing: verified on a 19.0 database that this change does not remove the warning.

The 4 Access Rights Inconsistency warnings are emitted while hr_holidays_attendance reloads its views during -u: at that point the validator combines the model access rows from the DB (which already include this module's ir.model.access for the portal group) with the field groups of the partially loaded registry, and only considers inheriting views of modules already loaded — so nothing defined in portal_holidays (Python groups or an inheriting view) takes part in that validation. group_ids on the hr_holidays_attendance extension view is rejected by _check_groups.

Reproduced: install 0 / -u hr_holidays_attendance 4 / -u portal_holidays 0, with and without this PR. At runtime the portal group reads the field and renders the form fine, so the warning is a validator false positive. The only code fix is upstream (groups="base.group_user" on the div in hr_holidays_attendance/views/hr_leave_allocation_views.xml, verified locally: 0 warnings, tests green); not pursuing it for now.