LPS-50479 ... The XML stuff

Hi Ray,
/cc @samuelkong @mikakoivisto

I know this is security related but there are changes to portal core that I'd like to discuss with you.

The biggest issue is that we trust all XMLs. We need to split that up based on trusted and untrusted input. The question is how far we want to go.

*The idea of this fix is:*
1, Add a security layer into all XML parsing ... represented by `SecureXMLBuilder` ... only refactoring to delegate all XML parsers initialization into `SecureXMLBuilderImpl`

2, Turn on the security inside `SecureXMLBuilderImpl` by disabling DTD processing
-- from this point all XML parsing is secured and many operations fail on DTD validation (DTD is disabled) ---

3, Introduce methods for trusted input where we allow DTDs ... `SAXParserUtil.readTrusted(...)`

4, TBD: Go case by case and decide what input is trusted and what is untrusted and use `SAXParserUtil#readTrusted()` or `SAXParserUtil#read()`. 

For example - is `resource-actions.xml` inside custom 3rd party plugin trusted? I'd say it depends on PACL enabled?

5, TBD: For untrusted input where we rely on DTD validation we have a problem. So here we probably need to create XSDs as @sustacek recommended: https://in.liferay.com/web/global.engineering/forums/-/message_boards/view_message/3858596

Currently I set all inputs to be trusted in the last commit so that we can start portal and do this review.

I'd like to ask everybody for their ideas. Thank you!