refactor: centralize XML import payload loading logic for alert/report/removal rules

[somethingwithproof]

Summary

XML import handlers duplicate the same payload loading logic in three files:

• syslog_alerts.php (alert_import(), around line 941)
• syslog_reports.php (report_import(), around line 803)
• syslog_removal.php (removal_import(), around line 741)

Shared pattern today:

• choose text payload vs uploaded file
• read uploaded file bytes
• redirect/exit when no payload

Why refactor

Fixes like #269 must currently be applied three times. A shared loader reduces repeated bug surface and keeps import semantics consistent.

Proposed change

Add a small shared helper that returns XML payload or triggers the existing redirect behavior; call it from all three import handlers.

Scope

Behavior-preserving refactor only, plus regression test coverage ensuring all three import handlers use the shared loader.