refactor: deduplicate bulk action item handling across alerts/reports/removal pages

[somethingwithproof]

Summary

form_actions() in the three rule pages repeats the same selected-items flow with small per-page differences:

• syslog_alerts.php (around line 109)
• syslog_reports.php (around line 106)
• syslog_removal.php (around line 114)

Shared pattern today:

1. parse drp_action
2. unserialize selected_items
3. iterate selected IDs and dispatch action callbacks (delete/disable/enable/export)
4. redirect back to page

Why refactor

This duplication increases drift risk and has already produced small inconsistencies (get_request_var() vs get_nfilter_request_var(), branch style differences, repeated count-for loops).

Proposed change

Introduce a small helper for selected-item processing and callback dispatch, then keep each page-specific action map local.

Scope

Behavior-preserving refactor only (no action semantics change), with regression coverage for shared handler behavior.