XML plugin: Add config page with access thresholds

Prior to this, any user of a MantisBT instance with the XML
Import/Export plugin enabled and knowing the URL to the plugin's import
page could upload an XML file and insert data without restriction,
regardless of their access level.

This vulnerability is particularly dangerous when used in combination
with the one described in issue #17725 (CVE-2014-7146) as it makes for a
very simple and easily accessible vector for PHP code injection attacks.

There was also no access check when exporting data, which could allow an
attacker to gain access to confidential information (disclosure of all
bug-related data, including usernames).

Fixes #17780 (CVE-2014-8598)
XML import plugin does not process links

There was an error in the if statement logic in ImportXML::import(), due
to an incorrectly placed closing parenthesis, the replace statement was
never executed.

Fixes #17774
XML import plugin: replace links in 'steps to reproduce'

Duplicates logic used to process links for 'description' field.

Fixes #17775
Remove useless 'e' modifier in bug link regex
XML Import: use new method to replace bug links

A new private method replaceLinks() was added to avoid code duplication.
Now replacement of buglinks for 'description', 'steps_to_reproduce' and
'additional_information' is performed via this method.
New BugData object due_date should be blank

Prior to this, the due_date field was initialized to 0, causing the date
to be incorrectly preset to 1970-01-01 00:00 UTC.

Fixes #17847
XML Import: HTML/CSS fixes
Whitespace
XML Import/Export plugin fixes

Pull Request #539