form_list does not use Base_edit

XXX TODO Formulator checkbox must be modified to not render an input when the field is in read only
Otherwise, in listbox, it creates an input inside a `a` element, which is not valid html

This reverts commit 689e242c.

Prevent generating wrong urls for now

romain_dev: forum

romain_dev: forum use html viewer

romain_dev: forum improve post rendering

romain_dev: thread reader use page language inqtead of local

romain_dev: forum set expected link on the listbox cells

romain_dev: thread fixup

romain_dev: thread use line separator instead of background color

romain_dev: thread paginate

romain_dev: forum link to last page

romain_dev: thread simplify conf from erp5form

romain_dev: forum attachment

romain_dev: thread force white background

This reverts commit e50d05af.

Do not access form submission REQUEST from the listbox list method,
as it is rendered asynchronously in ERP5JS

Allow edition in the new UI

This make everything slow as hell and prevent to quickly save.

Example: <h2 class="foo">bar</h2> => <h3 class="foo">bar</h3>

erp5_web_renderjs_ui: keep previous focus color

If user group are recalculated before changing the workflow state, it will only return the same security group
See nexedi/erp5@c00c3636

Using the display router command allows to drop the user search term
when moving from one access page to another.

Set the max-age value to 4h instead of 10min for the one-day-max policy
(ie, 24h/6, like one-hour-max uses 10min max age).

The idea is to reduce backend access of nearly static web sites,
while still allowing changes without waiting for too long before it is propagated.

`createSession` method from the OAuth2 Authorisation Server Connector needs
to access client value. Fetching this value from the session is not needed
since it is already stored in a local variable.

Malevolent users may decide to only - and repeatedly - present an otherwise
valid refresh token, causing the issuance of a new access tokens everytime,
likely along with new refresh tokens, causing many ZODB writes.
Avoid this by pushing the token expiration date by one lifespan accuracy,
so there can only be one write per session per lifespan accuracy period.

This partially reverts 8a336dc5 (erp5_accounting: Allow
Assignor manage Accounting Periods, 2024-09-16) for the restart
transition, it is intentional that only Assignor can restart
an accounting period that have been closed.
The idea was to support a scenario where re-opening a period
that was closed can not be done directly by the Assignee but
needs validation from the assignor.