[FIX] board: Do not offer to create dashboard when there is no action

In case we have no defined action (e.g. redirection by python code), adding a dashboard should not be possible as the rendering based on the action.
This patch hides the 'Add to Dashboard' button in search view (opw 611288)
[FIX] hr_holidays: employees cannot approve their holidays

Nor modify once approved

It wasn't possible for employees to approve their holidays themself, thanks to the GUI, but this was possible through xmlrpc calls, or when altering the html directly in the browser.
Besides, this was also possible to edit the holiday through the same trick once the holiday validated
[FIX] product_visible_discount: use order date to compute currency instead of current date
[FIX] sale_order_line: use order date to compute currency instead of current date
[FIX] security: ir.config_parameter should not be readable by externals
[FIX] security: externals should be able to read attachements

without having the rights to read ir.config_parameter
[FIX] security: res.groups should be readable by admins only
[FIX] security: remove read access on company critical fields
[FIX] security: disallow read on ir.sequence for externals
[FIX] email_template: security, email_template no rights for externals
[FIX] resource: security, resource not readable by externals
[FIX] account: avoid date and cache issues

Explicitely refresh invoice browse_record(...) in order to have correct 'date' in account.move.
Use context_today() date instead of time.strftime() for date_invoice. (opw 611210)
[IMP] report_sxw: missing parameter without_company for display_address

Fixes #811
[FIX] base: security: employee must have access to res.groups
[FIX] email_template: remove group restriction on field mail.compose.message.template_id

This was added as a security check, but access to this field is need by the wizard itself.
As non employee users can't read/create email templates, this will not be problematic
[FIX] l10n_ma: proper chart of account name
"[REVERT][FIX] point_of_sale: field date of report.pos.order should be a datetime"

This reverts commit 97d097a2af8c3992d5108bd75b82fa8479d196cc.

As explained in the commit comments (on Github), this patch leads to an infinite loop in 7.0, the filter of the pos orders report using the '=' operator in its domain, which is not available for datetime fields, but is for date fields.

This should not be forward ported to newer release (saas-3)
[FIX] mail: more robust parsing of In-Reply-To/References (OPW 608919)

When parsing incoming messages, ignore white-space around
In-Reply-To headers, and extract message-id items inside
the References header using a regex.
This actually serves as a workaround for broken MTAs
mangling References (such as outlook.com nesting past ones
with commas, violating RFC2822).

Closes #516 as a manual rebase.