Admin: Multiple releases cannot be selected in a Malware Report for quarantine or removal

[nnja]

Describe the bug

Path: admin/malware_reports/<report_id>/

Currently, all warehouse admin pages reject duplicate POST keys via the reject_duplicate_post_keys_view, with one legacy exception.

When attempting to select and submit multiple releases to either quarantine or remove in the Detail View for a Malware Report, the submission will return an error:

400 Bad Request
The server could not comply with the request since it is either malformed or otherwise incorrect.

POST body may not contain duplicate keys (URL: '<host>/admin/malware_reports/<report-id>/quarantine_release/')

Expected behavior
On the malware report page, it should be possible to select multiple releases to be marked for quarantine or removal.

To Reproduce

1. Login to an account that's marked as an observer
2. Create a malware report for at project//submit-malware-report/
3. From admin/malware_reports/ click through to the malware report page for the project

Issue 1: Failure to quarantine multiple releases:

1. Click on Quarantine Release
2. Select multiple releases
3. Submit
4. Results in a 400 error

Issue 2: Failure to remove multiple releases:

1. Click on Remove Release
2. Select multiple releases, enter a reason, confirm by typing the project name
3. Submit
4. Results in a 400 error

My Platform

Verified in a local development environment.

Additional context

[miketheman]

@nnja Thanks - you might have caught something I fixed yesterday in #20222 - can you pull main and verify?

[nnja]

My last fetch is from yesterday morning, so let me grab the latest version of main and verify your fix.

I did work on a PR for this yesterday but went with a slightly different approach -- since setting permit_duplicate_post_keys=True allows all POST keys to be duplicated, including ones like CSRF tokens I added an allow list to specify which keys can be duplicated.

If you'd like to take a look, I'd be happy to submit a PR

[nnja]

@miketheman

I pulled and verified, and looks like #20222 is a partial fix.

Multiple releases can now be submitted for deletion, but not for quarantine (Affected view: admin.malware_reports.detail.verdict_quarantine_release).