Fixes possible access bypass when displaying actions selectable to users on the VBO Views forms.
See Views Bulk Operations (VBO) - Less critical - Acce - SA-CONTRIB-2020-003.
This release resolves SA-CONTRIB-2020-002.
Changes since 8.x-1.0:
Fixes Radix - Moderately critical - Cross site scripting - SA-CONTRIB-2020-001
Changes since 7.x-3.7: