fix(actions): prevent bulk actions from affecting all runners (#38453)

[GiteaBot]

Backport #38453 by @dreamstarsky

Keep the selected runner IDs synchronized with the bulk action form and reject requests without valid IDs. Add integration regression tests.

This fixes a severe and destructive bug in the site-admin runner bulk actions introduced by #37869.

Before this fix, every bulk operation always affected all registered runners, regardless of which runners the administrator selected. This affected the Disable, Enable, and Delete actions. In the most serious case, selecting a single runner and confirming the bulk deletion could delete every registered runner.

The frontend populated the hidden ids field only once during page initialization, before any runner was selected. It was not updated when the checkbox selection changed, so bulk requests were submitted with an empty ID list.

The backend then passed the empty list to FindRunnerOptions. An empty IDs value means that no ID filter is added to the database query, causing all runners to be loaded and modified.

This PR:

• synchronizes the hidden runner IDs whenever the selection changes;
• rejects bulk requests without valid runner IDs before querying or modifying runners;
• restores the intended bulk action button classes so the selected runner count is displayed;
• adds integration coverage to ensure an empty-ID delete request is rejected without deleting any runners.

Before

untitled.mp4

After

fixed.mp4

Fixes #38449

AI assistance disclosure: OpenAI Codex was used to assist with investigation, implementation, testing, and drafting this pull request. The changes were reviewed and manually tested by the author.