Disable external entities in XMLReader

Temporarily disable loading entities in XMLReader when calling read()
with libxml_disable_entity_loader(true).

(cherry-pick from 1ed76385c31f44c589f6e5a99c9c56f1f3f76728)

bug: 46859
Change-Id: I0b2ef270f15c7b4da17edee680bf7e2410919915
Merge "Disable external entities in XMLReader" into REL1_19