Refactor: libpacemaker: Move allow_modification into the library.

This code was previously in crm_ticket, but it really makes more sense
in the library where everyone can use it. This changes
pcmk_ticket_remove_attr and pcmk_ticket_set_attr to return EACCES when
attempting to change the granted status of a ticket. It's up to the
caller to display a message if appropriate.