Don't generate separate delete token for each attachment

Added optional $p_security_token param to form_security_param() in
form_api.php, just as with form_security_field(), to allow passing only
the security token, and not the pregenerated form_security_param()
string (suggested by @cproensa).

Fixes 0020142

Signed-off-by: Damien Regad dregad@mantisbt.org