[FIX] /web/binary/{image,saveas}: use request.registry instead of deprecated `request.session.model`

This makes the controllers work also for
public users, e.g. in the frontend.
[FIX] website_forum: avoid access error when closing spam/abuse questions

Logging the user login is not necessary, but
accessing it might cause access errors. Logging
the UID is equivalent anyway, so let's not bother.
[FIX] point_of_sale: correctly handle the rounding when the unit's rounding is set to zero
[FIX] point_of_sale: decimal precision was hardcoded to 2 in various places
[FIX] point_of_sale: some pos order fields were missing the proper decimal precision
[FIX] point_of_sale: use 'Product Price' decimal precision for product prices
[UP] Merged with upstream