HR Holidays Security

This module refines who can do what in the Time Off app for people who are set as a team's Time Off responsible but are not full Time Off managers.

• Approvals: a responsible can approve or refuse requests of employees they manage, but cannot approve their own requests (only a Time Off Manager can). Depending on the leave type's validation setting, the system checks that the user is the employee's manager or has the right Time Off role, and shows clear error messages otherwise.
• Allocations: responsibles can create allocations only for their team members, not for themselves. The list of leave types they can pick is filtered automatically. The description of an allocation is hidden (shown as *****) for employees outside their team, and only the employee concerned or their manager sees the real description.
• Screens: the leave and allocation forms used from the approval menus are replaced by versions restricted to the responsible's team, where the employee field only lists people they manage. The Reporting menu is now visible to Time Off responsibles.
• Access rules: reporting data is limited to the responsible's own team members, while approvers with the All Approver role see everything and regular users see only their own records.

The module touches hr.leave, hr.leave.allocation, ir.actions.act_window and the Time Off reporting model.