Follow-up on review

## Counter
Every tenant has its own tickets counter now (OA-1, OA-2...) instead of increasing the counter value for the shared instance.

## REST API
Removed the REST endpoints for requesting tickets since tickets only need to be 'requested' while fetching publications. The publications are decorated with their corresponding ticket.

## Permissions
Since not every user is allowed to see the corresponding tickets of publications, a check was added to see if the current user has a role. Only global admins, tenant admins in which the publication/ticket was created in, creators and authors of a publication can see a ticket.

##  Tests
Some dedicated tests were added that:
    - check if valid parameters are passed when requesting:
        - a single ticket
        - a range of tickets
    - check the permissions for attaching tickets when:
        - a publication is requested by its ID
        - a set of publications are requested by an author
        - a set of publications are requested by a creator
	- check the locking functionality while creating tickets
    - check that the created tickets correspond to their corresponding publications