Fix category does not exist error

If we get into a state where a category doesn't exist then we end up in a denial of service state.
This impacts pages like My View, View Issues, and others.

We can get into this state due to several cases that we should fix.  However, there is no reason why we won't handle them like we handle unknown enumerations.

This change adds a category_exists check in category_full_name() api, and changes category_exists to populate the cache to not incur extra overhead.

Fixes #15420
Hide news permissions when disabled

Fixes #16957
Relationship emails disclose related issue

This fix tackles the following scenarios:

- Users no longer get notified about relationships that they don't have access to.
- Users no longer see relationships listed in email notifications that they don't have access to.
- Users no longer see history events associated with relationships they don't have access to.
- Emails are constructed within the context of the target user not the logged in one.

Fixes #9885
Handler access checks in SOAP API

The mc_issue_add() and mc_issue_update() APIs were missing checks to validate that specified handler has the appropriate access level and that logged in user have access level to assign issues.

mc_issue_get() was also missing the check that the user has access to view the handler assigned the issue.

Fixes #16993
XML Import: Fix php code injection vulnerability

Egidio Romano discovered a vulnerability in the XML import plugin.

User input passed through the "description" field (and the "issuelink"
attribute) of the uploaded XML file isn't properly sanitized before
being used in a call to the preg_replace() function which uses the 'e'
modifier. This can be exploited to inject and execute arbitrary PHP code
when the Import/Export plugin is installed.

This fix is a partial backport from a master branch commit which has
been confirmed as addressing the issue (84017535f8718685d755d58af7a39d80f52ffca8)
excluding changes not relevant to fixing the security issue, including
subsequent fixes (aea1a348043979e75a6cc021e4a0a7f8d3bb7211,
4350b4d4f0ee4fba423edcae1cd2117dc1e2d63b).

Fixes #17725 (CVE-2014-7146)
XML plugin: Add config page with access thresholds

Prior to this, any user of a MantisBT instance with the XML
Import/Export plugin enabled and knowing the URL to the plugin's import
page could upload an XML file and insert data without restriction,
regardless of their access level.

This vulnerability is particularly dangerous when used in combination
with the one described in issue #17725 (CVE-2014-7146) as it makes for a
very simple and easily accessible vector for PHP code injection attacks.

There was also no access check when exporting data, which could allow an
attacker to gain access to confidential information (disclosure of all
bug-related data, including usernames).

Fixes #17780 (CVE-2014-8598)
XML Import: use new method to replace bug links

A new private method replaceLinks() was added to avoid code duplication.
Now replacement of buglinks for 'description', 'steps_to_reproduce' and
'additional_information' is performed via this method.

Backport from master 8e111abb1723a47e6d6ca90079221f88bb98b282

Fixes #17775
New BugData object due_date should be blank

Prior to this, the due_date field was initialized to 0, causing the date
to be incorrectly preset to 1970-01-01 00:00 UTC.

Backport from master 2d82b2430922e6bc0ac733007792955c92a4df05

Fixes #17847