[FIX] hr_holidays: remove now invalid xml attribute "model" (introduced by last forward-port)
[FIX] account: use method has_group() instead of browsing the group directly.
[FIX] base: security: employee must have access to res.groups
[MERGE] forward port of branch 7.0 up to f65c913
[FIX] mail: read ir.config_parameter with SUPERUSER_ID
[FIX] email_template: remove group restriction on field mail.compose.message.template_id

This was added as a security check, but access to this field is need by the wizard itself.
As non employee users can't read/create email templates, this will not be problematic
[MERGE] forward port of branch 7.0 up to 15ee4d8
[MERGE] forward port of branch saas-3 up to c914893
[FIX] website_hr: give public group the right to read resource.resource records
[MERGE] forward port of branch saas-5 up to 24c25f5
[FIX] base, mail: access to ir.config_parameter is now handled by by
record rules.

Partial revert of commit 80017b04c2fefe895659f56e5e8d34bd59093e13.

Conflicts:
	addons/web/static/src/js/chrome.js