CLSA-2026-1784291449 expat: Fix of 2 CVEs

CVE-2026-50219: reject libexpat API re-entry from inside handler callbacks to prevent use-after-free - CVE-2026-56131: extend the handler re-entrancy guard to XMLResumeParser - CVE-2026-56412: guard XMLTOKDATACHARS handler calls in doCdataSection...