[#1815] Fix XXE vulnerability in XML.getDocument()

and provide safe newDocumentBuilder() method for other uses.

By default Java XML parsers are vulnerable.