Purpose
=======
Allow sorting documents that created / move in a folder with AI.

Specification
=============
To achieve that result, we need to create a new type of server actions,
"AI". This type of server action can use other server action marked
as "Use with AI". We call the "Use with AI" server action "tools".
The LLM can ask to execute a tool with some parameter. That allow it
to move documents in a given folder, to rename a document,
log a note, etc.

We also need to be able to add binary file in the prompt,
for that purpose, we stop using QWeb, and we render ourselves the prompt with LXML.

Various fixes were applied along the way.

See underlying commits for more details about each of the changes.

Technical
=========
Mail alias: To not block the email CRON, when documents are sent to a
    folder with AI sorting enable, we delay the sorting (they will be
    sorted in a different CRON, and a ribbon message will be shown
    in the kanban view while they are waiting to be sorted)

Loop: We need to prevent loop in case the target folder is also marked
    as "AI sorted".

Prompt injection: The new server action code is vulnerable to prompt injection.
    An attacker could try to retrieve the information from the prompt
    by fooling the LLM into inserting those information in the result
    of the server action.
    Most obvious example is writing an unlimited free text into a readable record.
    Several measures are available to limit this when creating AI server actions:
    - End users should make careful use of the '/record' command to specify the
      possible "winner candidates" records of the server action.
    - The 'ai_tool_schema' can be used to limit the available outputs of the LLM
      (for example by truncating text to a certain limit)
    - The LLM can only execute a set of manually selected AI tools, these have to
      be carefully chosen to avoid unwanted side-effects as the LLM could be fooled
      into executing any of these tools with any arguments
    - Dynamic information inside the prompt is added using '/field', those values
      should be reviewed to make sure they do not contain sensitive information
    The AI server actions & tools provided as data in this PR have been reviewed
    by Odoo to make sure they follow these criteria.

Number of API calls: OpenAI always answer `"status": "completed"` after
    executing a tool (even if it's not finished) so even if the LLM
    will execute one action and stop, it will require 2 API calls
    (to be sure it's finished and that nothing else will be executed).
    In the last call, to specify it's done, there's no more tool call,
    and the LLM send eg `The documents has been moved to...`.
    Even if we say `When you are done, sent DONE`, it sends it in the
    last call. We could have limited the tools call to 1 for documents,
    to improve performance, but then we will restrict the feature.

AI module: The code is done in the `ai` module, because it's meant to
    replace `ai.tool`. For now, we keep the `ai_server_actions` module
    but it's only used for "update with AI" action, and will be merged
    with AI in the future.

Access check: We only check that we can execute the AI action, we skip
    all check on the tools. The reason is that it can be executed in a
    CRON on most cases anyway, so it's better for it to be explicit
    (and to have something consistent). If a tool has a group, then a
    warning will be shown to explain to the user that the LLM can skip
    the access check for this action.

Default folders: For other models, if we didn't insert records in the
    prompt, then we add the most used records. But for documents, they
    inherit from the accesses of the parent folder, and so it has
    security impact, so we don't insert the most used folders (if the
    user does not do /record in the prompt, then the LLM won't be able
    to move the documents).

Folders values: When inserting a record in the prompt, by default we
    just insert its display name. We want the LLM to have more
    information for the auto-sort, for example, if we have a folder
    "Belgium" inside "Finance", the LLM should be able to know that
    the Belgium folder is related to Finance.

Task-4915266

This commit enhances the functionality of accounting returns, specifically for audit purposes.
It introduces the concept of "Working Files", which are a type of accounting return designed to manually audit the financial and accounting status of a company. For returns of this type, a new view is available. To access it, create a working file, open the corresponding audit, click the top-right button to reveal the top bar, and select the "Balances" view.

The Balances view shows account balances over the audit period, along with additional columns such as:
 - The difference with the previous year
 - The audit status, which can be updated directly from the view
This status is also available and editable on some accounting reports like the trial balance and balance sheet.

Users can now create new return types (either tax return or audit) and configure fields such as periodicity and start date.

Additionally, a new model account.return.check.template is introduced, allowing users to define and manage checks (either on audit or tax return). Each check can be:
 - A manual validation
 - A document upload
 - An automated validation based on a domain

Audit checks are now grouped into cycles, which categorize checks by areas like fixed assets, inventory, operating expenses, etc.

Note: While not recommended, it is now technically possible to configure multiple returns of the same type within the same date range.

task-4840028

Before this commit, when the project is private and the user can only access to some tasks inside that project, he can create timesheets but cannot stop timer in one of those tasks when `industry_fsm` module is installed.

This commit makes sure the user can start/stop a timer on task for which he has access to even if the project is private and he does not have access to it.

Steps to reproduce the issue:
----------------------------

0. install industry_fsm module
1. Create a project A with "followers" as privacy visibility
2. Create a task A and assign it to a project user with lowest timesheet access right.
3. log in as that user
4. Start a timer on Task A
5. Stop the timer and confirm the wizard

Expected Behavior:
-----------------

The timesheet should be created without any issue

Current Behavior:
----------------

An Access error is raised because the user has no access to the project.

task-4680412

Forward-Port-Of: odoo/enterprise#91370
Forward-Port-Of: odoo/enterprise#84807

### Issue:
When creating a vendor with a bank account and certain fields configured, trying to register a payment could raise a KeyError: 'none'.

This was due to the incorrect order of validations in _check_for_qr_code_errors, introduced in PR #219566. This commit reorders the checks to ensure proxy_type is validated before being used.

### Affected Versions:
17.0 and later

### To reproduce:
1. Install account_accountant, l10n_vn
2. Select VN Company
3. Go to Accounting > Vendors > Vendors
4. Create a partner with country set to Vietnam
5. In Accounting tab, add a bank account with:
   - Account Name
   - Bank
   - Currency
   - "Send money" set to True
6. Go to Accounting > Vendors > Payments
7. Try to create a payment for that partner

##### Expected: 
Payment is created successfully
##### Current: 
KeyError: 'none' is raised

OPW-4976541

---
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr

Forward-Port-Of: odoo/odoo#221522