KRACOEUS-8181: convenient way to clear pessimistic locks to make it easi...

...er for testing.
I'd disagree about the idempotent part. Idempotent just means that the state of the server is the same for identical requests. So we can't delete the same object more than once which is true. But you would expect a different return code the second time. As far as the user clicking it twice, the front end should handle that by disabling the link until the first request has completed. In this example if the lock never existed they would still get an ok result.

Related to this though, is the intention of this that anyone can clear the lock when the param is enabled? No permissions or anything? Currently this would allow anyone who can authenticate to simply loop through all ids, sending delete requests with no other checks.