[17.0][IMP] auth_oauth_multi_token: make it compatible with odoo.sh "login as"

[CRogos]

Odoo.sh provides an option to login-in as a specified user.
When you install this OCA module auth_oauth_multi_token , the "connect" or "login as" of odoo.sh is not working anymore, but this is essential for the Odoo support.

This is caused by this change of the module:

server-auth/auth_oauth_multi_token/models/res_users.py

Lines 80 to 83 in 260f262

	def _get_session_token_fields(self):
	res = super()._get_session_token_fields()
	res.remove("oauth_access_token")
	return res | {"oauth_master_uuid"}

This causes, that the session_token (I assume generated by odoo.sh code) is not valid and the check here causes an automatic logout.
https://github.com/odoo/odoo/blob/7d3931bf36996cf5b51533e4a0a788ad8f3eb6c0/odoo/service/security.py#L11-L13C17

https://github.com/odoo/odoo/blob/7d3931bf36996cf5b51533e4a0a788ad8f3eb6c0/odoo/addons/base/models/res_users.py#L924-L941

My assumption is, that odoo.sh does not use the changes done by the _get_session_token_fields method, when creating the login session, but because the odoo.sh code is not public I cannot validate this assumption.

Meanwhile I also received and answer from Odoo and they are not willing/able to improve their implementation.

This PR bypasses the change of def _get_session_token_fields and therefore stays compatible with Odoo.sh

[pedrobaeza]

I think you need to write migration script for moving the values in oauth_master_uuid to oauth_access_token, isn't it?

[pedrobaeza]

You only need to define the default, isn't it?

[CRogos]

The origninal definition is this:
oauth_access_token = fields.Char(string='OAuth Access Token', readonly=True, copy=False, prefetch=False)

[pedrobaeza]

The redefinition of labels cause a mix of terms across the system sometimes, so it's not the best option. And the required=True will provoke troubles everywhere.

[CRogos]

I am also not very happy for reusing this field. We could leave the string value as is and just add an comment that this field is used as Master UUID instead of access_token.
The required=True I just took from the oauth_master_uuid field, but I am not sure if this is needed to force the default creation? It shouldn't be empty or the same value as another user, to make sure that the access_token is not used by a different user.

[CRogos]

I think you need to write migration script for moving the values in oauth_master_uuid to oauth_access_token, isn't it?

I've added a migration script.

I've also added a test and found out, that not the oldest but the second oldest token was removed when reaching max token number.

[CRogos]

@pedrobaeza could you have a look on the last update?