Fix: xml: Prevent incorrect xml diffs from corrupting the cib

This is found on v1.1.11 by developer's experiment:

cibadmin --query -o resources > cib-old.xml
cibadmin --query -o resources > cib-new.xml
vim cib-new.xml  # change Started to Stopped

Generate patch:
crm_diff --original cib-old.xml --new cib-new.xml > cib-diff.xml

Resulting patch:
```
# cat cib-diff.xml 
<diff crm_feature_set="3.0.8">
  <diff-removed>
    <resources>
      <group id="gp">
        <meta_attributes id="gp-meta_attributes">
          <nvpair value="Started" id="gp-meta_attributes-target-role"/>
        </meta_attributes>
      </group>
    </resources>
  </diff-removed>
  <diff-added>
    <resources>
      <group id="gp">
        <meta_attributes id="gp-meta_attributes">
          <nvpair id="gp-meta_attributes-target-role" name="target-role"
value="Stopped"/>
        </meta_attributes>
      </group>
    </resources>
  </diff-added>
</diff>
```

Applying this patch succeeds:
```
# cibadmin --patch --scope resources --xml-file cib-diff.xml
# echo #?
0
```
But the resulting CIB is broken: The patch has been applied on the root "cib" tag:

```
# cibadmin -Q --xpath "/cib/group"
<group id="gp">
  <meta_attributes id="gp-meta_attributes">
    <nvpair id="gp-meta_attributes-target-role" name="target-role"
value="Stopped"/>
  </meta_attributes>
</group>
```

-- We should prevent incorrect xml diffs from corrupting the cib. As we know,  in v1.1.12, it starts using xml_apply_patchset*() and __*_xml_object() functions for applying cib diffs -- the functions are safe in this case. While it seems to still make sense to add these for subtract_xml_object() and add_xml_object().