fix: handle missing selected user ids in bulk permissions

[xeseing]

Description

Fixes the default value used when parsing selected_userids in bulk permission routes.

Changes

• Updated add_bulk_permissions to default missing selected_userids to "[]"
• Updated modify_bulk_permissions to default missing selected_userids to "[]"
• Updated delete_bulk_permissions to default missing selected_userids to "[]"

Why

json.loads() expects a string, bytes, or bytearray. The previous default value was a Python list ([]), which can raise a TypeError if selected_userids is missing from the submitted form data.

Using "[]" keeps the intended empty-list behavior while passing a valid JSON string to json.loads().

Testing

• Ran python -m py_compile mslib/mscolab/blueprints/operation/__init__.py
• Reviewed the three bulk permission routes locally