**Current behavior:**
As of now, whenever a journal is set to "Hash on Post", the user is granted the secured group rights. This allows the user to see the lock icon in the status bar, the extra default filters in the list views of Journal Entries and Journal Items, and access to the Secure Entries wizard.

However, if only entries from journals with "Hash on Post" are secured, these features are not necessary. The user trusts Odoo to hash any and all entries that are posted in that specific journal.

**Expected behavior:**
When "Hash on Post" is active, the user does not need any additional user group. However, if even one entry is secured and does not belong to a journal with the "hash on post" feature, the user will then need access to the new features, such as the lock icon, default filters, and the Secure Entries wizard.

**Approach:**
This commit removes the calls to _activate_group_account_secured() when setting a journal to "Hash on Post". It also removes it from the Secure Entries wizard. Instead, we add the key 'journal_restrict_mode' to the chains_to_hash, which indicates the value of the journal's restrict_mode_hash_table field. If at least one chain with moves does not have 'journal_restrict_mode', only then we call _activate_group_account_secured()  from _hash_moves(). This will only happen when the Secure Entries wizard is used, hashing entries from all journals.

task-4348380

---
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr

In 18.0, we dropped the support for the round per line rounding method in Mexico. 

However, we didn't think about the following scenario:

- a user creates an invoice in 17.0 in round-per-line mode, and sends it to the Mexican government without problem
- they then upgrade to 18.0
- a while later, they receive payment for the invoice. They then try to send the payment CFDI to the Mexican government. 

The payment CFDI is a complicated beast because it needs to retrieve values from the invoice the payment was reconciled with. Since the amounts in the invoice are slightly different from what they should be in round globally, the payment CFDI gets incorrectly generated and gets rejected by the Mexican government.

So we need a temporary fix that allows the values of the payment CFDI to be adjusted according to the values of the invoice, which works even if the invoice used round per line.

This fix is inspired by the existing solution in version 17: https://github.com/odoo/enterprise/pull/68319
and ensures that the "importe" amount is properly calculated.

opw-4537931
opw-4536649
opw-4528785
opw-4490806