Use ZendXML

- Uses ZendXML instead of disabling the entity loader
- Fixes some more potential XXE issues

@butonic Please test properly. Not sure whether this works 100%.
This breaks parsing html and xhtml files. html because they are not well formed, making the parser choke on them. xhtml because I then need to register a namespace to use before doing xpath queries on them. the latter is fixable (and I already have it working) but do we really need to replace DOMDocument::loadHTML with XmlSecurity::scan?