Add a Tier-2 vs Tier-3 ACL sweep test so viewer-only grants fail CI instead of breaking Tier-3 roles

[gonzalesedwin1123]

Deferred from #454's PR description, where it was gated on #422 landing; both #422 and #454 are now on 19.0, so this is unblocked.

Why

#353 (merged via #422) re-pointed the program/CR roles from Tier-2 group_registry_viewer to Tier-3 group_registry_read. Because Tier-2 implies Tier-3, the swap can only lose ACLs — and it silently did, which is what #454 had to restore. The restoration was found by diffing viewer-granted vs Tier-3-granted models against a live database; nothing prevents the same regression from recurring the next time a module grants a model to the viewer tier only.

The #454 review also showed the limits of hand-maintained model lists: the per-module test_registry_read_access.py tests assert exactly the models someone already thought of, which is how the spp.program blind spot (#463) survived. A sweep computes its expectations instead of enumerating them.

What the test should assert

A post-install sweep, living next to spp_change_request_v2/tests/test_cr_roles_registry_scope.py (which #353 introduced for the role scoping itself):

1. Compute {models readable by a pure Tier-2 viewer user} minus {models readable by a pure Tier-3 read user} via ir.model.access.check over installed models.
2. Assert the residual equals an explicit, documented allowlist of intentional Tier-2-only models (per fix(security): let Tier-3 registry read reach the registrant form's models #454's final state: res.partner.bank is a false positive — Odoo base grants it to base.group_user — plus the spp.dci.* models, spp.disable.registrant.wizard, spp.queue.background.task, and the two consent wizards whose exclusion fix(security): let Tier-3 registry read reach the registrant form's models #454's changelog documents).

A new viewer-only grant then fails CI with a message pointing at the tier decision, instead of shipping a registrant-form AccessError for Tier-3 roles.

Worth pairing with #463's functional web_read test idea: the sweep catches ACL-tier drift; the functional test catches models granted to neither tier that the registrant form nonetheless renders (the spp.program case).

Context: #353, #422, #454 (review + PR description note), #463.