WIP: Xxe

[MarkBaker]

This is:

- [ ] a bugfix
- [X] a security fix
- [ ] a new feature

Checklist:

• Changes are covered by unit tests
• Code style is respected
• Commit message explains why the change is made (see https://github.com/erlang/otp/wiki/Writing-good-commit-messages)
• CHANGELOG.md contains a short summary of the change
• Documentation is updated as necessary

Why this change is needed?

Changes to the xml security scanner to use libxml_disable_entity_loader() when cleanly supported and thread-safe, and to handle UTF-7 charset which otherwise permits an XXE exploit

[MarkBaker]

Need to enforce "doctrine/instantiator": "1.0.5" in composer.json (or ^1.0.0) for PHP 5.6; doctrine/instantiator 1.1.0 (if allowed) will break unit tests against PHP 5.6... composer should handle ^1.0.0 correctly when running on travis against 5.6

[PowerKiKi]

should probably use lowercase method name