Fix code scanning alert no. 6: Resolving XML external entity in user-controlled data

[hazendaz]

Fixes https://github.com/mybatis/mybatis-3/security/code-scanning/6

To fix the problem, we need to disable the parsing of DTDs and external entities in the DocumentBuilderFactory. This can be done by setting specific features on the DocumentBuilderFactory instance. The changes should be made in the createDocument method of the XPathParser class.

1. Disable DTDs by setting the feature http://apache.org/xml/features/disallow-doctype-decl to true.
2. Disable external general entities by setting the feature http://xml.org/sax/features/external-general-entities to false.
3. Disable external parameter entities by setting the feature http://xml.org/sax/features/external-parameter-entities to false.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[coveralls]

coverage: 87.113% (-0.009%) from 87.122%
when pulling 650146b on autofix/alert-6-2d7812d9b9
into 45953df on master.

[hazendaz]

@harawata Any idea why we would have this value set to true when its known to be vulnerable? ibatis-2 has that too. Switching it all tests work. I'm wanting to merge it as it is the right thing to do but trying to understand who/why we would have had that for probably 20 years since ibatis has same issue.

[harawata]

Thank you, @hazendaz ,

I checked the logs, but couldn't find anything (and the default value is true actually).
Let's merge this PR and see what happens.