Close XXE vulnerability in ERRest's XML parser

[hugithordarson]

As per discussions about the vulnerability on the WOCommunity slack channel on 2020-12-03. Fixes reflect OWASP recommendation from here: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html

[paulhoadley]

This change appears to conform completely with the advice in the OWASP XML External Entity Prevention Cheat Sheet relating to the matter.

[paulhoadley]

This appears to be a complete implementation of the OWASP advice.

[hprange]

I did a quick test using one of our apps. That's the response for a request using the XXE attack before applying this patch:

<?xml version="1.0" encoding="UTF-8"?>
<String>Failed to parse a [ERXRestFormat: xml] request. Failed to parse request document. /etc/passwd (Permission denied).</String>

The app tried to access the file system.

And the response to the same request after applying this patch:

<?xml version="1.0" encoding="UTF-8"?>
<String>Failed to parse a [ERXRestFormat: xml] request. Failed to parse request document. DOCTYPE is disallowed when the feature &quot;http://apache.org/xml/features/disallow-doctype-decl&quot; set to true.</String>

It looks good to me.