Update drupal core to fix XML security bug.

#6477