[augusto-weiss]

Depends on #1022 (19.0 migration, not merged yet): this branch carries its history.

Migration changes:

• _auth_method_oauth_provider takes the new routing argument of ir.http in 20.0.
• Access rights converted to ir.access with Odoo's upgrade_code.
• Password grant: validate_user authenticates like Odoo RPC (interactive: False):
  accepts an RPC API key instead of the password, requires it when the user has 2FA,
  and no longer logs a web session in. It was broken since 17.0 (Session.authenticate signature).
• /oauth2/token no longer forces all client scopes on the token: it gets the requested
  scopes, and with the authorization code grant the scopes granted to the code.
• Refresh token grant: it keeps working once the access token expired (the lookups ignore
  the computed active filter), and the new token gets the owner of the refreshed one
  (validate_refresh_token sets it). The controller no longer passes the user through
  oauthlib extra credentials, so odoo_user_id is not in the token response anymore.
• /oauth2/tokeninfo: expires_in uses the whole lifetime (timedelta.seconds dropped the days).
• /oauth2/revoke_token: csrf=False (external clients can not send a CSRF token), no more
  500 on auth="none" (odoo_user.active read with sudo), and it also finds the refresh
  token of an expired access token.
• readonly=False on the routes that write (auth="none" routes are readonly by default).
• README moved to readme/ fragments; /oauth2/otherinfo documented as deprecated.

Tests:

• They were disabled (commented imports) and relied on removed APIs (WebRequest,
  wsgi_server): the controller base now uses HttpCase, with its own user (no demo data).
• The shared tests live in mixins and did not run (allow_inherited_tests_method).
• 181 tests green locally (183 on a database without demo data). New tests for
  /oauth2/resources/<model>, API key + 2FA, code scopes, refresh and revoke with an expired
  access token, expires_in over a day, revoke without CSRF, the state roundtrip with unsafe
  characters.

CI note: tests pass; checklog fails on a core warning while compiling web.assets_frontend
without html_editor (odoo/odoo#287582), see the comment below.

Open questions:

• API keys created in 19.0 with an empty scope and the 20.0 non-interactive login, which looks
  for scope = 'rpc'.
• The access rights keep their xmlids but move from ir.model.access to ir.access; Odoo's
  upgrade converts them, not checked with OpenUpgrade.

[augusto-weiss]

Tests are green (172, 0 failed / 0 errors). The red comes from checklog, on a core warning
while compiling web.assets_frontend:

Error: argument `$color` of `rgba($color, $alpha)` must be a color

Since 7c69596e7997, web/static/src/scss/bootstrap_review_frontend.scss uses
increase-contrast, which is only defined in html_editor. On a database without
html_editor (as in CI: only base, web and this module) the frontend bundle does not
compile. This module renders web.login_layout in its authorization tests, so it hits it.
Fix pending in odoo/odoo#287582. #1040 (auth_saml) fails the same way.