Disable external entities in XMLReader

Temporarily disable loading entities in XMLReader when calling read()
with libxml_disable_entity_loader(true).

bug: 46859

Change-Id: I0b2ef270f15c7b4da17edee680bf7e2410919915
Merge "Disable external entities in XMLReader" into REL1_20