[16.0][IMP] budget,budget_appropriation,budget_appropriation_summary: improve permission controls

[n3n]

Summary

• Enforce group_budget_commitment on commitment reserve/obligate/consume actions, with is_auto_created flag so mixin-created commitments bypass the check
• Add groups="budget.group_budget_manager" on transfer Approve/Reject/Post buttons (XML) alongside existing Python has_group checks
• Require budget manager to post all appropriation types (previously only initial); restrict button_draft to the responsible user or manager
• Require budget manager for compilation action_done and action_draft, with guard preventing draft revert when master summary is already confirmed/done
• Add groups="budget.group_budget_manager" on master summary and compilation buttons (Confirm/Done/Back to Draft)
• Enable perm_write and perm_unlink on all operating unit ir.rules across 3 OU modules for full read/write/delete isolation

Test plan

• Verify budget_user cannot see Reserve/Obligate/Consume buttons on commitment form (requires group_budget_commitment)
• Verify mixin-created commitments (from PR/PO) still auto-reserve without group check
• Verify budget_user cannot see Approve/Reject/Post buttons on transfer form
• Verify budget_user cannot post any appropriation type (initial or supplementary)
• Verify only responsible user or manager can reset appropriation to draft
• Verify budget_user cannot see Done/Back to Draft buttons on compilation and master summary
• Verify compilation cannot revert to draft when master summary is confirmed/done
• Verify operating unit isolation blocks cross-OU write/delete via RPC