AZL-7156 CVE-2022-22822 affecting package expat for versions less than 2.4.3-1

addBinding in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow...