[FIX] mail: allow post on model with readonly access when authorized

The attribute _mail_post_access='read' on a model class allows to post on that
model with readonly access. But when providing an attachment such action was
throwing a security error due to the check done on the attachment. Indeed
adding an attachment to a model is modifying that model so the write access
is needed. To solve this problem, we add the attachment in sudo in the
'_message_post_process_attachments' method.

Justification

This is an internal method and we have stated in its documentation that it is
the caller responsibility to check the rights. Actually, the checks are done at
mail.message creation (to which the attachment are linked) by the override
of 'check_access_rule' which calls '_get_mail_message_access' which takes into
account that attribute (_mail_post_access). Moreover sudo is already used
in '_message_post_process_attachments' to link existing attachments. Here we
add a sudo for the new attachments as well.

Note

This fix allows the test 'test_post_with_read_access' to pass (located in
test_mail/tests/test_mail_multi_company.py). But it is currently hard to
reproduce functionally as

  - answering an email works as it is executed by the cron;
  - replying in discuss trigger a multi company error no matter there is an
    attachment or not (so it is another problem);
  - sending a message (with readonly access) on a thread from the interface
    works without this fix because the attachment are created beforehand and
    the part that handle already existing attachment is already in sudo;

Multicompany issues will be solved in the next commits.

Task-3178885 (Mail: fix 'readonly' post support)

X-original-commit: odoo/odoo@f9a6f7f7ce
Part-of: odoo/odoo#114511

addons/mail/models/mail_thread.py

@@ -2082,6 +2082,13 @@ class MailThread(models.AbstractModel):
             content (body) through CIDs body is updated. CIDs are found and
             replaced by links to web/image as CIDs are not supported as it.
 
+        Note that attachments are created/written in sudo as we consider at this
+        point access is granted on related record and/or to post the linked
+        message. The caller must verify the access rights accordingly. Indeed
+        attachments rights are stricter than message rights which may lead to
+        ACLs issues e.g. when posting on a readonly document or replying to
+        a notification on a private document.
+
         :param list(tuple(str,str)) or list(tuple(str,str, dict)) attachments:
           list of attachment tuples in the form ``(name,content)`` or
           `(name,content, info)`` where content is NOT base64 encoded;
@@ -2166,7 +2173,7 @@ class MailThread(models.AbstractModel):
                 # keep cid, name list and token synced with attachement_values_list length to match ids latter
                 attachement_extra_list.append((cid, name, token))
 
-            new_attachments = self.env['ir.attachment'].create(attachement_values_list)
+            new_attachments = self.env['ir.attachment'].sudo().create(attachement_values_list)
             attach_cid_mapping, attach_name_mapping = {}, {}
             for attachment, (cid, name, token) in zip(new_attachments, attachement_extra_list):
                 if cid: