Investigate Performant XML Identification

[andrewstucki]

Describe the enhancement:

#22940 adds code for mime type sniffing. Currently, if an xml document doesn't begin with an <?xml signature the way the code determines if it's xml is by unmarshaling everything and seeing if an error occurred. Go's xml implementation is pretty bad in terms of speed and memory pressure. We should replace this with a more scalable implementation. See #22940 (comment) for some ideas for identification rules for an XML document.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[jlind23]

Backlog grooming: Closing it for now until further activity.