XML Import: Fix php code injection vulnerability

Egidio Romano discovered a vulnerability in the XML import plugin.

User input passed through the "description" field (and the "issuelink"
attribute) of the uploaded XML file isn't properly sanitized before
being used in a call to the preg_replace() function which uses the 'e'
modifier. This can be exploited to inject and execute arbitrary PHP code
when the Import/Export plugin is installed.

This fix is a partial backport from a master branch commit which has
been confirmed as addressing the issue (84017535f8718685d755d58af7a39d80f52ffca8)
excluding changes not relevant to fixing the security issue, including
subsequent fixes (aea1a348043979e75a6cc021e4a0a7f8d3bb7211,
4350b4d4f0ee4fba423edcae1cd2117dc1e2d63b).

Fixes #17725 (CVE-2014-7146)
XML plugin: Add config page with access thresholds

Prior to this, any user of a MantisBT instance with the XML
Import/Export plugin enabled and knowing the URL to the plugin's import
page could upload an XML file and insert data without restriction,
regardless of their access level.

This vulnerability is particularly dangerous when used in combination
with the one described in issue #17725 (CVE-2014-7146) as it makes for a
very simple and easily accessible vector for PHP code injection attacks.

There was also no access check when exporting data, which could allow an
attacker to gain access to confidential information (disclosure of all
bug-related data, including usernames).

Fixes #17780 (CVE-2014-8598)
XML Import: use new method to replace bug links

A new private method replaceLinks() was added to avoid code duplication.
Now replacement of buglinks for 'description', 'steps_to_reproduce' and
'additional_information' is performed via this method.

Backport from master 8e111abb1723a47e6d6ca90079221f88bb98b282

Fixes #17775
New BugData object due_date should be blank

Prior to this, the due_date field was initialized to 0, causing the date
to be incorrectly preset to 1970-01-01 00:00 UTC.

Backport from master 2d82b2430922e6bc0ac733007792955c92a4df05

Fixes #17847