expat: mark as keg-only

For what I assume are Historical Reasons, expat notes in its caveats that it shadows the system expat library but is not actually keg-only. The include and lib names both clash (including the versioned dylib, which still contains `.1.` even though we're shipping expat 2.x).