Issue #3607819: Confine bulk cancel/migrate to the operator's tenant

Frank Mablyrequested to merge
issue/orchestra-3607819:3607819-bulk-cancelmigrate-on into 1.x

Fixes the cross-tenant IDOR on the instance-list bulk Cancel/Migrate actions by tenant-filtering selectedInstances() for non-administrators (mirroring InstanceDeleteConfirmForm). Adds a kernel test. See #3607819.

Merge request reports