CSRF & XSS on some importers

[xknown]

On trunk, Ultimate Tag Warrior and Category to Tag Converter are vulnerable to CSRF and XSS.

Proof of Concepts

1. CSRF: Convert all categories to tags without user confirmation.  http://localhost/wp/wp-admin/admin.php?import=wp-cat2tag&step=4

2. XSS: Someone has commited code to debug wp-cat2tag converter:

   echo '<!--'; print_r($_POST); print_r($_GET); echo '-->';
   

   It allows XSS attacks:

   http://localhost/wp/wp-admin/admin.php?import=wp-cat2tag&--><script>alert(/XSS/)</script>
   

Avoid CSRF and XSS on some importers

I'm partially to blame for the UTW importer (didn't check it over before committing) and wholly to blame for the second one (bad coding).

+2 to the patch.

(In [5941]) Add nonces to tag importers. Props xknown. fixes #4811