1. As some document fields are used to determine right access to it (ex: access_internal) and other are not meant to be read/modified by portal users (ex.: requestee_partner_id), we restrict the fields that can be read and
written for portal user:
- either by excluding them completely using groups on field definition
- or by excluding them from a writable whitelist of field for portal user. Note that we have chosen to list the writable fields rather than listing the readonly fields to avoid error of giving too much write access to the portal user.

We enforce that in the create, write, action_update_access_rights and a few other methods that write in sudo on documents.

For portal users, we limit the deletion of documents to their own documents (in python as it is done in stable).

We also override fields_get to avoid displaying not relevant fields in the interface (mainly in the search panel).

2. We also disable for portal user, the actions they cannot perform.
In the "New" drop down button:
- hide "Folder" (create Folder)
- hide "Link" (create link)
In the cog menu:
- disable shortcut as it requires access to partner_id
- Info&Tags as it opens the chatter which is disabled for portal user
- remove "Move to Trash" as portal user can't archive document (and can't create folder nor access to the trash anyway)
In the preview:
- hide Split Pdf in the preview
In action:
- Info&Tags as it opens the chatter which is disabled for portal user

For the internal user, we prevent the "duplicate" action to be shown when the user cannot duplicate the current selection.

Notes about point 1:

Unfortunately, some inherited fields are still accessible but mail.thread and mail.activity.mixin have already most of their fields protected and the remaining ones are not critical. We think also that the exposed fields of "mail.alias.mixin" are not criticals.

Solutions discarded:
- we haven't dynamically modified the field definition (adding group dynamically) because it can only be done in the init function that is only executed during upgrade.
- we haven't restricted the access to portal by overriding framework method (check_field_access_rights, _determine_fields_to_fetch) link in project because it was complex and not reliable (because of computed field in sudo/sql, especially for fields inherited by delegation).

[IMP] documents: allow portal user to delete their own documents

Instead of enabling the Trash for the portal user, we add the delete action for their own documents only so that a user that have uploaded a document by mistake can delete it. Indeed, as portal user don't have access to the Trash, moving a document to the Trash like an internal user would do is no use.

[FIX] documents: fix attachment not pointing to the copied document

When copying a document, the copied attachment still points to the orginal record:
- if it is a document with an attachment associated to an other record (ex.: hr.expense). The attachment of the copied document is pointing to the same record as the orginal document. Ex.: for an expense, the expense has now
2 attachments linked (one linked to the original document and one linked to the copied one).
- if it is a pure document, the attachment points to the orginal document

We solve that problem here by always making the copied attachment to the copied document.

How to reproduce case 1:
- Install documents_hr_expense
- Upload a document in the Document App
- Create an expense from that document
- Duplicate that document
- Open the expense App
- The expense related to the document has now 2 attachments instead of one

How to reproduce case 2:

I didn't find any more a way to reproduce it in the inteface but it is still possible to reproduce it in the shell:
- Install documents
- run the shell and type:

```python
import base64
marc = env['res.users'].search([('login', '=', 'demo')])
doc = env['documents.document'].create({
    'type': 'binary',
    'datas': base64.b64encode(bytes("TEST", 'utf-8')),
    'name': 'file.txt',
    'mimetype': 'text/plain',
    'owner_id': marc.id,
})
docs = doc | doc.copy() | doc.copy()
docs.mapped('res_id')
docs.mapped('attachment_id')
docs.mapped('attachment_id.res_id')
doc.unlink()
docs[1].exists()
docs[2].exists()
```

Exemple of output:
```
>>> docs.mapped('res_id')
[114, 114, 114]
>>> docs.mapped('attachment_id')
ir.attachment(1383, 1384, 1385)
>>> docs.mapped('attachment_id.res_id')
[114, 114, 114]
>>> docs[1].exists()
documents.document()
>>> docs[2].exists()
documents.document()
```

It means that deleting the original document (or even a copy) deletes all copies.

Task-4221258