CSRF & XSS on some importers

[xknown]

On trunk, Ultimate Tag Warrior and Category to Tag Converter are vulnerable to CSRF and XSS.

Proof of Concepts

1. CSRF: Convert all categories to tags without user confirmation. ​http://localhost/wp/wp-admin/admin.php?import=wp-cat2tag&step=4

2. XSS: Someone has commited code to debug wp-cat2tag converter:

   echo '<!--'; print_r($_POST); print_r($_GET); echo '-->';
   

   It allows XSS attacks:

   http://localhost/wp/wp-admin/admin.php?import=wp-cat2tag&--><script>alert(/XSS/)</script>
   

[xknown]

Avoid CSRF and XSS on some importers

[rob1n]

I'm partially to blame for the UTW importer (didn't check it over before committing) and wholly to blame for the second one (bad coding).

+2 to the patch.

[ryan]

(In [5941]) Add nonces to tag importers. Props xknown. fixes #4811