[FIX] security: ir.config_parameter should not be readable by externals