[ADD] base_tier_validation: dedicated manager group, menu out of Technical

[bosd]

Problem

Managing tier definitions today requires giving a user access to
Settings > Technical: the Tier Validations menu is nested under
base.menu_custom, tier.definition write is gated to
base.group_erp_manager, and tier.validation.exception write to
base.group_system. There is no dedicated tier-validation group.

For deployments where a trusted client key user should maintain tier
definitions, the only option is granting erp-manager / Technical
access -- which lets them damage the whole system. We need a
least-privilege path.

Change

• New security group Tier Validation Administrator
  (group_tier_validation_manager) under a new Tier Validation
  module category, so it is a clean selectable role in
  Settings > Users.
• ir.model.access rows granting that group CRUD on tier.definition,
  tier.validation.exception and tier.review.
• The Tier Validations menu is relocated out of Settings >
  Technical to a top-level menu, gated by the new group.
• Back-compat: base.group_system implies the new group, so existing
  administrators keep full access and still see the (now top-level)
  menu. Existing erp_manager / group_user access rows are left
  untouched.
• Manifest load order: the new security/tier_validation_groups.xml
  loads before ir.model.access.csv (which references the new group).

Open question for reviewers

An erp_manager who is not also a system admin keeps
tier.definition write via the existing access_tier_definition_settings
row, but loses automatic menu visibility once the menu leaves
Technical. Left as-is per the requested design (only group_system
implies the new group). Happy to also add
base.group_erp_manager -> implied if reviewers prefer.

Tests

test_35_manager_group_can_configure_without_technical:

• a user with only group_user + group_tier_validation_manager
  (no system / erp_manager / Technical) can create and write a
  tier.definition;
• a plain group_user user gets AccessError;
• a group_system user implies the manager group (back-compat).

Scope

19.0 only for now. The 18.0 backport (OCA/server-ux, identical menu /
security structure) is deferred to a separate follow-up.

[OCA-git-bot]

Hi @LoisRForgeFlow,
some modules you are maintaining are being modified, check this out!