Bulk Update Ignore Comment

Apply one ignore comment to several risks.

Same company/suppression/permission guards as POST /risks/{id}/ignore. Does not stamp review_status — a marketer ignore never did. When selection is present, the drawn box is stored as training data in the same transaction.