[FIX] security: ir.config_parameter should not be readable by externals
[FIX] security: externals should be able to read attachements

without having the rights to read ir.config_parameter
[FIX] security: res.groups should be readable by admins only