**Current behavior:**
As of now, whenever a journal is set to "Hash on Post", the user is granted the secured group rights. This allows the user to see the lock icon in the status bar, the extra default filters in the list views of Journal Entries and Journal Items, and access to the Secure Entries wizard.

However, if only entries from journals with "Hash on Post" are secured, these features are not necessary. The user trusts Odoo to hash any and all entries that are posted in that specific journal.

**Expected behavior:**
When "Hash on Post" is active, the user does not need any additional user group. However, if even one entry is secured and does not belong to a journal with the "hash on post" feature, the user will then need access to the new features, such as the lock icon, default filters, and the Secure Entries wizard.

**Approach:**
This commit removes the calls to _activate_group_account_secured() when setting a journal to "Hash on Post". It also removes it from the Secure Entries wizard. Instead, we add the key 'journal_restrict_mode' to the chains_to_hash, which indicates the value of the journal's restrict_mode_hash_table field. If at least one chain with moves does not have 'journal_restrict_mode', only then we call _activate_group_account_secured()  from _hash_moves(). This will only happen when the Secure Entries wizard is used, hashing entries from all journals.

task-4348380

---
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr