group_id is used as key of OOBtree and as documented, it's not
possible to mix keys that can not be compared, so we can not have a mix
of string and bytes, for consistency with other BTrees, such as the
ones used for OFS.
group_id is also used in a SQL column which is BINARY, this is
problematic on py3 because the selected values will be returned as bytes,
but we expect str here. Because we don't want to run a data migration,
we adjust the select methods to convert to str while selecting.

Since years there was a warning that id_group must be a string, now we
make it a bit stricter, we also enforce that the id_group is valid UTF-8.

A few more tests and assertions were also added.

Reviewed-on: !1980

The ssl/x509 were renamed after we decided to change the name of the
holding property sheet during the code review. The code was updated,
but not this form

  Otherwise it gets other unrelated objects from a full text search

This is tested in test_14_multiple_workflow_different_permission_roles

See merge request nexedi/erp5!1982

Otherwise
  https://example.com/foo
would match
  https://example.com/
but not the language-selector
  https://example.com/en/

and not as manager, as some scripts in the workflow have proxy roles, so
it would be nice to test them too.

The CA certificate can be stored on the connector (it is obtained from
the clammit instance).

To store properties related to x509 certificates, used for exemple in
TLS connections

When commiting from ERP5, they are always alphabetically ordered.
So commit the list of property sheets ordered alphabetically to ease to decrease
the number of diffs when commiting from ERP5.

   Fix inconsistency on guard and permissions

   Fixup the inconsistent restart/restart_action transition, that has
     Assignee/Assignor guard in am inconsistent matter.

   Allow assignor have the same permissions and guard than the assignee

   Fix up permissions on delivered state, where the Assignor had no
   permission to view/access accounting period (so deliver by assignor
   only was impossible).

See bcd82831

See bcd82831 (comment 216152)

The main query to the hateoas web section must be cache by the browser,
to reduce the number of queries by 2.

Caching policy manager conditions are checked before calculating the query result,
and so, it is not possible anymore to wait for the script to explicitely
ask for the result to be cached.