Fix XXE issue

[This is for @tguild and @ylafon to review]

This fixes a security issue. It can be tested with the following input:

```xml
<?xml version="1.0"?>
<!DOCTYPE html
[
  <!ENTITY test SYSTEM "file:///etc/passwd">
]>
<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
  xmlns:dc="http://purl.org/dc/elements/1.1/">
  <rdf:Description rdf:about="http://www.w3.org/">
    <dc:title>&test;</dc:title> 
  </rdf:Description>
</rdf:RDF>
```

The fix is ugly because neither `com.hp.hpl.jena.rdf.arp.ARP` nor `org.apache.xerces.parsers.SAXParser` would expose the underlying Xerces parser, so this relies on reflection.

I have also done some clean-up by updating the dependencies.