[#1815] Fix XXE vulnerability in XML.getDocument()

and provide safe newDocumentBuilder() method for other uses.

By default Java XML parsers are vulnerable.

Rebasing an earlier pull-request to 1.3.x branch.