[IMP] mail: restrict create for internal same as write & read

Before this revision, an employee could create a discuss channel
with whatever setup he wants.
Which is fine. The critical part is for an employee to not be able
to join an existing restricted channel.
But creating a channel is not a problem.

However, he would be able to create a channel for which
he doesn't have access, meaning he creates the channel
and then no longer see it, which is not user-friendly.

closes odoo/odoo#139903

Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>

addons/mail/security/mail_security.xml

@@ -23,8 +23,6 @@
                                 ('group_public_id', 'in', user.groups_id.ids)
                 ]
             </field>
-            <field name="perm_create" eval="False"/><!-- create follows access rules (allowed for internal and system) -->
-            <field name="perm_unlink" eval="False"/><!-- unlink follows access rules (allowed for system) -->
         </record>
 
         <record id="ir_rule_discuss_channel_group_system" model="ir.rule">

addons/mail/tests/discuss/test_discuss_channel_access.py

@@ -123,7 +123,7 @@ class TestDiscussChannelAccess(MailCommon):
             ("user", "group_failing", "member", "read", False),
             ("user", "group_failing", "member", "write", False),
             ("user", "group_failing", "member", "unlink", False),
-            ("user", "group_failing", "outside", "create", True),
+            ("user", "group_failing", "outside", "create", False),
             ("user", "group_failing", "outside", "read", False),
             ("user", "group_failing", "outside", "write", False),
             ("user", "group_failing", "outside", "unlink", False),