Add the OpenTicket transition right and deny it to the public user

There's still a Privileged/Unprivileged split between Bitcard and OpenID
users internally, so denying it is unfortunately necessary.