libxml2: explore the new XML_PARSE_NO_XXE parse option

[flavorjones]

GNOME/libxml2@02cc5c36 introduced a new parse option, XML_PARSE_NO_XXE to "disable loading of external content".

Given the history of working around XXE vectors, I want to make sure I understand how the flag is implemented (what it does), craft appropriate tests for it, and support it in versions of libxml2 that provide it.