slapos_erp5: production users can create invitation token

slapos_erp5: do not allow creating Contract Invitation Token anymore

slapos_erp5: invitation token roles

slapos_erp5: trigger invitation token local role generation

slapos_erp5: is an Invitation Token a ticket?

slapos_erp5: test invitation token roles

slapos_erp5: roles for Assignment Request

- accountants can see Subscription Request to pay deposit
- provide permission to create automated payment transaction

  The hardcoded trade condition dont exist anymore, so create one
  to ensure it is reseted.

   ledger cannot be changed otherwise the lines aren't grouped automatically like before.

   Otherwise, whenever you run the tests multiple times, it ends up failing by selecting the wrong one on the listbox.

   Be consistent and also search for a Remote Node, since it can also contain Compute Partitions.

  The trade condition is only mandatory for automated invoices, if the accountant does things manually, it is
  not required to create/use one.

   We do expect that all trade conditions be attached to a business process, so for manual accounting
   the condition changed.

    Se would like to skip consistency check if the invoice isn't automated (ledger) and has no lines,
   otherwise this consistency check should still apply as usual.

   Only require project when ledger is automated
   Accept no ledger (1 or 0) on accounting transactions in case manual accounting is used.

   Let the site administrator configure proper accounting instead.

   Business Process are mandatory for Trade Condition, so this process covers
   manual accounting.

   This patch would replace guard for deliver_action to not call isDivergent that would make slow when open a Transaction (I don't remember the reason exactly, probably due large simulation trees).

   This breaks guards when simulation is not used (so it will never be solved) since the transition would never be allowed to the accountant.

   So if isDivergent proves itself slow, we should patch differently, for now keep the original implementation, since it is proven to work.

Reopen the support request when a new event is created

See: https://lab.nexedi.com/nexedi/slapos.core/-/blob/5e430ca2f21110900226c351bc5f5867e1ed3afe/slapos/slap/hateoas.py#L462

See merge request nexedi/slapos.core!677

   Shadow user have no access to Allocation Supply exclusive to the user, so access the variation before change into shadow user.

   Include a constraint to ensure group is set when function/accounting/{agent,manager} is used on
   assignments.

   This custom approach is used on Panel View and it is only working properly for Panel View since the gadget that will be redirected into is the slapos_panel_view.

   When use normal renderjs_runner it may cause confusion, so keep the URLs just pointing to normal locations.

   This helps administrator to identify which project the ticket is related too.

    This ticket list is broken and it is duplicated with Panel View anyway.