Disable external entities in Import

Temporarily disable loading entities in XMLReader when calling read()
during import.

bug: 47251

Change-Id: I0b39386e6cf4ec0244aab8ebc4095922511e2964
Merge "Disable external entities in Import"