Hiding timesheets only through the portal template left the timesheet
report reachable: /my/tasks/<id>?report_type=pdf renders all of a task's
timesheets via sudo, regardless of the template variable, so a portal
user could still download them.

Override account.analytic.line._show_portal_timesheets() to return False
(the core hook that drives the template variable, replacing the fragile
xpath that set it) and gate the report controller on the same method, so
both the page and the downloadable report are consistently suppressed.

Also add the manifest summary and maintainers.