Improved XMLInputFactoryUtils.newSafeInstance 

javax.xml.stream.isReplacingEntityReferences doesn't prevent entity
replacement within attributes
Merge pull request #30 from copierrj/3.2-pre8-backport

3.2 pre8 backport