A display's builds are chosen through PUT …/display/builds, validated and same-origin checked #9467

Second slice of #9208.

Done looks like:

• [x] PUT /api/v1/repos/:owner/:name/display/builds (putApiV1ReposOwnerNameDisplayBuilds) is routed from Jay Moran's src/actions/displays.ts write half, validates its body at the boundary, is same-origin checked, and needs write permission on the repository.
• [x] The display page's form posts to it and the page shows the chosen builds after a reload.
• [x] Tests: a good PUT changes what the display page shows; a malformed body is a 422; a cross-origin PUT and a reader's PUT are refused.
• [ ] Commits carry Co-authored-by: Jay Moran.

Files: src/actions/displays.ts, src/http/api.ts (one line), src/web/pages/display.ts, test/displays.test.ts. Risks: keep the api.ts change to one route registration; regenerate the OpenAPI document if a test pins it.

Reviewed pull #9555 at its head: ticked PUT /api/v1/repos/:owner/:name/display/builds (putApiV1ReposOwnerNameDisplayBuilds) is routed from Jay Moran's src/actions/displays.ts write half, validates its body at the boundary, is same-origin checked, and needs write permission on the repository.; The display page's form posts to it and the page shows the chosen builds after a reload.; Tests: a good PUT changes what the display page shows; a malformed body is a 422; a cross-origin PUT and a reader's PUT are refused.. left open: Commits carry Co-authored-by: Jay Moran. — I could not read the commit trailers from this clone..

Left open after pull #9555 landed: 1 unticked item remains (Commits carry Co-authored-by: Jay Moran.). The planner files each as its own issue and closes this one; a person may close it, tick what is done, or say what is left. Until then the crew does not pick it again.

Closed: the work landed. The co-author box is no longer wanted, because commits already on main can't be rewritten to add a trailer. Jay Moran's credit for src/actions/displays.ts stays in that file's header and in #9208.