Use PHP DOMDocument for XML validation

This would be less memory efficient than the current XMLReader, but
we're already loading the DOM into memory anyway to do security checks,
so it's no real loss.

Using the DOM means that we're not using libxml2's streaming API any
more, so this fixes #12