Fix request #7458: External XML Entity Injection

A authenticated user in position to exploit this issue would be able to
read the files from the system and thus affect it’s confidentiality.

More details on XXE:
https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Processing

This impacts:
- load of xml configuration (agiledashboard, trackers, …)
- soap documentation
- migration tv3 ⇒ tv5
- Instant Messaging

Please note that the fix is based on php function
libxml_disable_entity_loader() which:
- is available since PHP 5.2.11 (PHP 5.1.6 will have to upgrade to PHP
  5.3)
  http://php.net/libxml-disable-entity-loader
- is not thread safe
  https://bugs.php.net/bug.php?id=64938

Change-Id: I6fb08c070de8f14bafc122d43a074a747d845fb6
Tuleap 7.5.99.10

Change-Id: I3277c3025977aa9b6da19cb6040c1acdb8190e9e