accounting: allow Associate role to pass transitions on accounting transactions

f0808ac6 (workflow: add workflow transition guard for non-user
actions as well., 2015-11-18) broke some custom security
configurations where doing an action on a document would modify an
accounting transaction - but the user doing this action does not have
access to accounting.

This repairs the situation for accounting, by using the Associate
role. The idea is that for such patterns where users "do something
which will interact with accounting", the users also need an
Associate role on accounting transaction portal types, which is in
line with the meaning of Associate.