Fix ticket observer can edit additional fields

[Herafia]

Checklist before requesting a review

Please delete options that are not relevant.

• I have performed a self-review of my code.
• I have added tests (when available) that prove my fix is effective or that my feature works.
• I have updated the CHANGELOG with a short functional description of the fix or new feature.
• This change requires a documentation update.

Description

• It fixes !46589
• An observer on a ticket could modify and save custom fields
  because rights were only checked at the container-profile level, not against the
  specific item. Fields are now rendered as read-only for users who cannot update the
  item, and the pre_item_update hook enforces the same check server-side.

12 -> 11
#1278

Screenshots (if appropriate):