[FIX] res.font: add access right: read allow for all user and all allow for group_user
[FIX] base_language_install: add access right: access for group_user
[IMP] tools: mail: have a strict mode for html_sanitizer (not default) with
options before website: without frames, with safe attributes only.
We will have to find a way to use the strict mode when parsing incoming
emails, but not when sending or storing openerp content.

Currently the not strict mode is the default one, to avoid side-effects with
the website.