[REV] hr_holidays: revert "[FIX] hr_holidays: officers can CRUD leaves for their companies"

This commit was not correct and was a quick fix to avoid blocking daily use
of odoo saas-11.3. Next commit will fix access rights and enforce their
definition through more detailed tests.

This reverts commit ae34db3221.

This commit is linked to task ID 1876795 and PR #26656 .

addons/hr_holidays/models/hr_leave.py

@@ -411,7 +411,7 @@ class HolidaysRequest(models.Model):
         for holiday in self:
             validation_type = holiday.holiday_status_id.validation_type
             manager = holiday.employee_id.parent_id or holiday.employee_id.department_id.manager_id
-            if (validation_type in ['manager', 'both']) and (manager and manager != current_employee)\
+            if (validation_type in ['hr', 'both']) and (manager and manager != current_employee)\
               and not self.env.user.has_group('hr_holidays.group_hr_holidays_manager'):
                 raise UserError(_('You must be %s manager to approve this leave') % (holiday.employee_id.name))
             elif validation_type == 'manager' and not self.env.user.has_group('hr_holidays.group_hr_holidays_manager'):

addons/hr_holidays/security/hr_holidays_security.xml

@@ -38,7 +38,7 @@
     <record id="hr_leave_rule_officer" model="ir.rule">
         <field name="name">Leaves Officer</field>
         <field name="model_id" ref="model_hr_leave"/>
-        <field name="domain_force">[('employee_id.company_id', 'child_of', user.company_id.id)]</field>
+        <field name="domain_force">['|','|','|', ('employee_id.user_id', '=', user.id), ('department_id', '=', False), ('department_id.manager_id', '=', False), ('department_id.manager_id.user_id', '=', user.id)]</field>
         <field name="groups" eval="[(4,ref('hr_holidays.group_hr_holidays_user'))]"/>
     </record>