Before this commit, when the user creates a custom filter in SO model to
select the SO in which there is at least one task linked to a specific
project, he got an error saying the domain is invalid.

This commit fixes the issue by improving the search method implementing
for the `task_ids` field to make sure the search view supports a query
contained inside `value` parameter.

Steps to reproduce the issue:
----------------------------

0. Install `sale_timesheet` module with demo data
1. Go to Sales app
2. Creates a custom filter and select `Tasks associated to this sale >
   Project` as left part, `=` as operator (second field in the custom
   filter) and `After sales-service` as project (right part, last field
   in the custom filter).
3. Apply the custom filter

Expected behavior:
-----------------

The custom filter should be applied without any issue.

Current behavior:
----------------

The user has an error saying the domain is invalid when he tries to
save/apply his custom filter.

Forward-Port-Of: odoo/odoo#200743
Forward-Port-Of: odoo/odoo#200130

Before this commit all systray items of website were hidden for users that did not have the Restricted Editor right.

This commit limits only some of the items to users having the Restricted Editor right:
- Published: unrelated
- Mobile preview: unrelated
- Website switcher: unrelated
- + New: Restricted Editor only
- Edit in backend: unrelated
- Translate: Restricted Editor only
- Edit: Restricted Editor only

It therefore now shows the Published button only based on the result of the `_compute_can_publish` method of the `website.published.mixin`. The default implementation now checks whether the user has write access to the `website_published` field on the record.

Steps to reproduce:
- Install `website_crm_partner_assign`.
- Connect as a user without any Website role, and in Sales, the "User: Own Documents Only" role.
- Go to a partner in the `/partners` page. => "Published" button did not appear.

And on the contrary:
- Connect as a Restricted Editor user without Sales rights.
- Go to a partner in the `/partners` page.
- Click on "Published". => An access right error notification did appear.

task-3175890

Forward-Port-Of: odoo/odoo#198208
Forward-Port-Of: odoo/odoo#112421

Prior to this commit, attempting to print a receipt for a paid order in the PoS restaurant with l10n_sa_pos installed resulted in an error. In later versions, the process would fail silently. This error occurred because the getReceiptHeaderData method in the PoS restaurant used ‘this.get_order()’ to retrieve the order, which is not applicable for paid orders.

The order is now passed as an argument to the getReceiptHeaderData function, allowing it to be used when assigning the is_settlement field.

This was actually resolved in PR: #145252 but was accidentally reverted during this PR: #142566

Current behavior before PR - 
In saas-17.4, we get a traceback for the is_settlement field
In 18.0+ it will silently fail

Desired behavior after PR:
Print the order

Steps to reproduce:
1.) Install
point_of_sale;
pos_restaurant;
l10n_sa_pos;
2.) This should have created a company 'SA Company' with the country code of 'SA', currency of 'SAR', country_id of Saudi Arabia. If not create one and activate it.
3.) Create a Restaurant point of sale shop
4.) Create a sale > validate so we had orders in the 'Paid' state
5.) Ensure no table is selected
6.) Navigate to orders > filter 'Paid'
7.) Select a paid order and 'Print Receipt'

---
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr

Forward-Port-Of: odoo/odoo#200607

### Steps to reproduce:
- Create a new invoice
- Attach a ZIP file then a PDF file
- The file viewer shows but tries to preview the ZIP file
- Happens with all non-viewable files

### Cause:
The ZIP file is put as main attachment and the method `register_as_main_attachment` only change the main attachment (with `force=False`) when there is no main attachment.

The behavior of the file viewer is problematic because we cannot switch between the attachments in the preview, so we cannot see the PDF. But if we add another PDF file (so one ZIP and 2 PDFs), we can switch but it will never show the ZIP again, only the two PDFs. This behavior is due to the [next/previous arrows](https://github.com/odoo/odoo/blob/e4da068d6c9c8885dd4663d50dee11c9ea1516a3/addons/mail/static/src/components/web_client_view_attachment_view/web_client_view_attachment_view.xml#L13) being displayed only if [`attachmentsInWebClientView`](https://github.com/odoo/odoo/blob/e4da068d6c9c8885dd4663d50dee11c9ea1516a3/addons/mail/static/src/models/attachment.js#L323-L328) contains more than one item. But this list only contains viewable attachments (PDF or Images), and the next/previous arrows only take attachments from this list. As the arrows are [changing the main attachment](https://github.com/odoo/odoo/blob/e4da068d6c9c8885dd4663d50dee11c9ea1516a3/addons/mail/static/src/models/web_client_view_attachment_view.js#L17) to change the displayed preview, it never comes back to the problematic ZIP file.

### Solution:
Also display the arrows if the main attachment is not viewable and there is more than one attachment.
This way the user can return in the list of viewable attachments.

This is not an optimal because Odoo will still try to display the ZIP file, but it is a simple fix that works. 
I tried restraining the main attachment field only to viewable files in this [PR](https://github.com/odoo/odoo/pull/196390), but it seems to break things specially with OCR extraction and apparently it is sometimes wanted to have an XML as main attachment.

opw-4486363

Forward-Port-Of: odoo/odoo#200427
Forward-Port-Of: odoo/odoo#196446

Purpose
=======
In the Facebook settings, a user can ask an application (eg Social) to remove his data.

If the deletion is not implemented, it should be done manually for each user, and so we want to automate that process.

Technical
=========
The deletion process is done in that order:
1. The user go to his settings and ask Odoo to remove the data we have
2. Facebook will hit an endpoint in IAP, with a signature, and the  Facebook user id
3. IAP will reach the database, (with a shared secret to authenticate itself) and that endpoint will remove the social accounts, and also the social posts / templates if the account is selected

We do it that way, instead of having a CRON on the client database, because we are able to know if the user uninstalled social, or if he already removed the account.

If the database is not reachable from the internet, we will have it's dbuuid, and so, we will be able to take an action.

Authentication
==============
IAP needs to authenticate to the Odoo database,
so both need to share a secret.

That secret can not be the extended token,
because we don't store it on the Odoo side.

That secret is derived from the database secret, and sent when we ask the Facebook URL (in python, without a browser redirection), so the social user can not see it (otherwise, he will be able to bypass company access rules, and delete the social accounts of different company).

Setup
=====
1. Start Odoo and IAP instances
2. Start ngrok on the IAP port
3. In the Facebook settings ("Facebook Login For Business" -> Settings)
    - Add <ngrok_url>/api/social/facebook/1/callback in the Facebook settings
    - Add <ngrok_url>/api/social_facebook/1/deletion_callback in the Facebook settings
4. Add the Facebook credentials in the IAP settings
5. In the Odoo db, add the system parameter `social.social_iap_endpoint` with the ngrok url
6. In the IAP db, change the system parameter `web.base.url` with the ngrok url
7. In the IAP code, in `facebook_controller.py`, comment the dbuid check `_check_has_access`
8. Add your accounts
9. Go to `https://www.facebook.com/settings/?tab=business_tools`, and remove the app
10. Go to the "Removed" tab, then "View Details" and click on "Send Request"

Task-4350697

Forward-Port-Of: odoo/enterprise#74865

__Steps to reproduce:__
- Navigate to *Working Schedules* > *Standard 40 hours/week*
- Remove the Lunch period
- Create overlapping `Morning` and `Afternoon` periods on multiple days
  - Example: Morning: `08:00` to `12:00`, Afternoon: `12:00` to `16:00`
- Go to *Planning* > *New*
  - Generate a slot within this period as an open shift
  - Go to the next week and select *Copy previous week*
- Traceback error appears:  
  - `TypeError: '<' not supported between instances of 'NoneType' and 'datetime.datetime'`

__Description of the issue:__
- In Planning, `calender._attendance_intervals_batch` function returns dict() of `workInterval`, which does not merge overlapping intervals. The  `_merge` function in `Intervals` assumes input intervals are already merged, This mismatch caused issues in the planning app when unmerged overlapping intervals were passed to `_merge`

__Description of the solution:__
- Convert `workInterval` instances to `Intervals` by passing `workInterval._items` directly to `Intervals`, as it performs merging on overlapping intervals during instantiation. 

- bug introduced in: [#f283540][1]
- opw-4282039

[1]:https://github.com/odoo/odoo/commit/f283540336b29037fe8af9c1a951c3d27c941b3d#diff-357c95d58ea67c00f24d3a4c5a8a987041c42de13ca9f5535e7bb250b2927af6L214

Forward-Port-Of: odoo/enterprise#73618