To reproduce:

1. setup user with permissions to create architectures
2. make sure you have less than 6 OS in Foreman
3. login as that user, try to create architecture
4. you can see all OSes listed there even if the user does not have any OS
permission

Note that when there are 6 or more OSes, association is authorized properly.

The code that's responsible for this can be found at [1]. I believe it's
present since Foreman 1.1 [2]. Since this is in generic helper, each form
using this helper is vulnerable. It looks like the >= 6 code path (via multiple_select) had
authorisation implemented in #7337 for 1.9.0, and the < 6 code path was left untouched.

[1] https://github.com/theforeman/foreman/blob/develop/app/helpers/form_helper.rb#L48-L58
[2] https://github.com/theforeman/foreman/commit/14d225cc561b6fb2678eb87e9323d7750a06195c