When a new version is created from the salary configurator,
a tracking message summarizing field changes is posted on
the employee chatter. This message may contain sensitive
payroll information such as wage and yearly cost, which
should not be visible to users outside the payroll group.

Previously, all tracking messages on hr.employee were
visible to any user with access to the employee record.
After the mail tracking refactor introduced in task (3645865)
(https://www.odoo.com/odoo/project/1251/tasks/3645865),
tracking values are now rendered directly into the message
body, making the old field-level filtering mechanism no
longer applicable.

To restore payroll visibility restrictions:
* Tracking values linked to payroll-restricted fields are
  separated from regular tracking values during `_track_log`.
* Payroll-sensitive tracking values are posted in a dedicated
  tracking message using the subtype
  `mt_hr_payroll_sensitive`.
* Regular tracking values continue to use the standard
  tracking flow and remain visible to all users with access
  to the employee chatter.
* Employee chatter message fetching is overridden to hide
  payroll-sensitive messages from users outside
  `group_hr_payroll_user`.
A test was also added to ensure payroll-sensitive tracking
messages remain hidden from non-payroll users.
Task: 4985543