v15.64.1

## Bug Fixes
* Restricts access to files attached to a document to users who can read that document. Requires write access to **Shift Type** before automatic attendance can be processed. (https://github.com/frappe/hrms/pull/5239)
* Removes fixed letterheads from the "Employee Exits", "Leave Ledger", and "Income Tax Computation" reports so they use the default letterhead. (https://github.com/frappe/hrms/pull/5249)
* Removes the empty **Leave Period** card from the **Employee Grade** form. (https://github.com/frappe/hrms/pull/5255)
* Fixes automatic attendance so it marks an employee absent for each overlapping **Shift Assignment** when no default shift is set. (https://github.com/frappe/hrms/pull/5246)

## Other Changes
* Restricts requests that create, update, or delete records across roster, attendance, leave, payroll, and recruitment to POST requests instead of allowing GET requests. (https://github.com/frappe/hrms/pull/5228)

**Authors**: @Shllokkk, @iamkhanraheel, @akhtarmohsin
**Reviewers**: @deepeshgarg007, @asmitahase

<details>
<summary>AI content</summary>

 For these release notes, we used an LLM (OpenAI gpt-5.6-luna) to review and summarise the code changes, along with the associated issue and PR descriptions. It may contain typical errors and inaccuracies. You can read the prompt [here](https://github.com/barredterra/pretty_release_notes). 

Changes with the following labels were excluded:
- skip-release-notes

Changes with the following types were excluded:
- ci
 - chore
 - build
 - style
 - test
 - refactor
 - docs

</details>