[19.0][FIX] payroll: add security group to payroll fields on hr.version and hr.employee

[neoand]

Problem

Odoo 19 hardened HR field visibility. hr.version and hr.employee are now expected to declare a
security group on payroll-sensitive fields, and core ships tests that enforce it
(hr.tests.test_payroll_fields_access, hr.tests.test_self_user_access).

This module declares groups on payslip_count only. struct_id, schedule_pay and slip_ids
have none, so the salary structure and the payslip list are readable by any HR user and leak into
employee public profiles:

AccessError: The fields "slip_ids,struct_id,schedule_pay", which you are trying to read,
are not available for employee public profiles.

How to reproduce

On a fresh database with odoo:19.0 (Community):

odoo -d <db> -i payroll --test-enable --stop-after-init

Before this change: 3 failed, 1 error of 1087 tests

FAIL: TestPayrollFieldsAccess.test_payroll_fields_are_hidden_to_non_payroll_users_in_employee_form_view
  AssertionError: ['struct_id'] is not false : [hr.employee] Missing payroll group on following fields
FAIL: TestPayrollFieldsAccess.test_payroll_fields_are_hidden_to_non_payroll_users_in_version_form_view
  AssertionError: ['schedule_pay', 'struct_id'] is not false : [hr.version] Missing payroll group on following fields
ERROR: TestSelfAccessPreferences.test_employee_fields_groups
  odoo.exceptions.AccessError: The fields "slip_ids,struct_id,schedule_pay" ... not available for employee public profiles

(The fourth failure, calendar.test_event_notifications.test_email_alarm, is unrelated to this
module.)

Fix

Add groups="payroll.group_payroll_user" to the three unprotected fields, matching what
payslip_count already does.

Verified at the registry level after the change:

Field	groups before	groups after
hr.version.struct_id	(none)	payroll.group_payroll_user
hr.version.schedule_pay	(none)	payroll.group_payroll_user
hr.employee.slip_ids	(none)	payroll.group_payroll_user
hr.employee.payslip_count	already set	unchanged

The module's own test suite still passes (27 tests).

Note for reviewers

Core's _test_payroll_fields_are_hidden_to_non_payroll_users accepts only
hr.group_hr_manager or hr_payroll.group_hr_payroll_user — the latter being the Enterprise
module's group. A module using OCA's own payroll.group_payroll_user therefore still trips that
specific assertion even though the underlying access control is now correct.

This PR fixes the actual data exposure. Whether the upstream check should also accept an
equivalent community group is a separate discussion, and I'm happy to follow whatever the
maintainers prefer here (e.g. adding hr.group_hr_manager alongside).

---

Assisted-by: Claude Opus 4.8

Disclosed per the OCA Generative AI / LLM Policy.
Developed and verified under my direction and review; I take responsibility for the contribution.

[OCA-git-bot]

Hi @nimarosa, @appstogrow,
some modules you are maintaining are being modified, check this out!

[CristianoMafraJunior]

https://github.com/OCA/.github/blob/master/AI_POLICY.md

[neoand]

Thanks for pointing me to the policy — that one's on me, and it's fixed now.

The commit was using Co-authored-by: for the AI tool, which the policy rules out. I've amended it
to use the Assisted-by: trailer instead and added the disclosure to the description.

Happy to answer anything about the implementation directly — I'd much rather work through review
comments than regenerate the patch. Thanks for taking the time to look at it.