\* = im_livechat, portal, web

Validating access in controllers based on generic queries is slow, so it needs to be removed.

It also grants more access than necessary, effectively making some avatars fully public depending on hard to track states or relations, when it only needs to be available in a specific context.

Access could be validated with more specific queries instead, for example for a specific thread. While that solves the biggest performance issue, it's still not the fastest, but more importantly it requires a lot of contextual info to be forwarded to the route. And having one route per thread removes the ability to cache the avatar between various context (in particular from one channel to the next). Also avatar are not always displayed in the context of threads, so it doesn't fully resolve the issue and requires to think about more conditions and more contexts.

The generic token of the target record could be used when it exists, but the token could be used to leak other information (portal, ...), and it doesn't always exist.

This commit introduces a solution resolving all issues, with almost no drawback. The access is granted through a token which is specific to displaying the avatar. The token is only given when necessary, so minimal access is granted in all cases. The token is the same in all contexts, allowing caching. Validating the token is much faster than making queries. The token has an expiration date to minimize data access in time, but it can be refreshed at any time if the user can still access the source of the token.

https://github.com/odoo/enterprise/pull/74167