Steps to reproduce:
-------------------
1. Install l10n_au_hr_payroll.
2. Enable multi-company and switch to an AU company.
3. Change an existing employee’s company to the AU company
([employee created more than 28 days ago](https://github.com/odoo/enterprise/blob/7adab8bfdccf5f0e97eb2894e065b63ea8200d20/l10n_au_hr_payroll/data/hr_payroll_dashboard_warning_data.xml#L31)).
4. Under the payroll tab, set the TFN Status to:
"Employee applied for TFN but didn't receive it yet, less than 28 days ago".
5. Open Payroll.

Issue:
--------
A traceback occurred:
```
Error: NameError("name 'invalid_employees' is not defined")
```
Cause:
------
The evaluation code computes `warning_count` using
an undefined `invalid_employees` variable.

Solution:
---------
Define `invalid_employees` before using it to compute
`warning_count` and `warning_records`.

**NOTE:**
The [upgrade script](https://github.com/odoo/upgrade/blob/ed5bc3fd99ef6fba4bc7162934df36396ae9fc3f/migrations/l10n_au_hr_payroll/saas~18.4.1.0/end-migrate.py#L30) is already available from version 18 to 19.

opw-5459998

Forward-Port-Of: odoo/enterprise#103777

**Steps to reproduce:**
- Go to Appointment app
- Edit an appointment type
- Ensure its availability is on resources
- Set duration to 1 hour
- Add a schedule slot ending in 00:00
- Save and go to the website page of the appointment
- Last slot is not showing (23:00-00:00)

**Issue:**
When computing the appointment slots of a resource using time range,
the end of day is considered as an unavaibility resource slot with this interval
in `_get_unavailable_intervals`:
`i_start = 23:59:59.999999` `i_stop = 00:00`
this conflicts with the given range (23:00-00:00)
in `self._slot_availability_is_resource_available`

It comes from `_attendance_intervals_batch`, as `float_to_time(24.0)`
is converted to `time.max` (23:59:59.999999) by:
`day_to = datetime.combine(day, float_to_time(attendance.hour_to))`
This introduces the microsecond unavaibility at the end of the day, which
blocks the booking.

(it's working properly for availability on users appointments)

**Fix:**
Changed the condition so that 23:59:59.999999 is considered as equal to 00:00.

opw-5163892

Forward-Port-Of: odoo/enterprise#104927
Forward-Port-Of: odoo/enterprise#100853

The aim of this commit is to make the automatic reconciliation works in
case of an obvious matching that was prevented because the reference of
the invoice was also it's payment reference.

It also modify a docstring of a test because it was lying about what it
was really testing. The usecase it says it forbid is actually enforced
by `test_matching_algorithm_for_multiple_invoices`.

### Before this commit:
- functionally:
  The obvious matching was denied and the accountant had to manually
  make the match.

- technically:
  The `aml.ref` and the `move.payment_reference` were the exact same and
  thus postgres regrouped the invoice (through aml) with itself as if
  there were 2 invoices matching the same word.

### After this commit:
- functionally:
  The obvious match is made.

- technically:
  The initial intend was to avoid having several invoices
  (proxy by amls) reported for a specific matching word preventing the
  system to take a difficult and arbitrary functional decision which
  might be wrong.
  In order to comply with that and to not block the match of an invoice
  that would be matched through several matching words, we don't gather
  twice the same aml for the same word.

task-id: None (The issue arose on odoo.com and was brought by APFA)

**Issue**
Users without 'Admin' Sign rights could in some cases not access the sample template.

**Steps to reproduce**
1. Go to 'Templates' and archive the existing one in order to have the 'Try our sample document' shown and click on it.
2. Add some sign items to the template, and send it for a signature request.
3. With an user having only 'User: Own Templates' Sign rights, go to 'Templates' and click 'Try our sample document'.

Access Error:
Blame the following rules:
- sign.item: group_sign_user: Create and manage template items

**Cause**
When the template has an associated sign request, it is copied.
The problem is that the user currently doesn't have enough rights
to create sign items for the copied template:
https://github.com/odoo/enterprise/blob/2e8fb2ca274a0cf15d7b78a663bffe9cbb700153/sign/security/security.xml#L92-L101

**Change**
Change the `user_id` of the new template to allow creating the sign items for it.

opw-5254566

Forward-Port-Of: odoo/enterprise#102227