Disable external entities in Import

Temporarily disable loading entities in XMLReader when calling read()
during import.

(cherry-pick from 77a8d576918b6a47b80a67a3653662a2d705d6c3)

bug: 47251
Change-Id: I0b39386e6cf4ec0244aab8ebc4095922511e2964