Prevent XXE attacks by disabling external entities resolution in the default parser

Signed-off-by: Ryan Senior <ryan.senior@puppetlabs.com>