Make XmlReaderSettings globally configurable

[MarvinPogoda]

This is a short term workaround to remove a possible attack surface for XXE-Attacks mentioned in #262 .

[paulushub]

It is a good idea, but only used in SharpVectorModel/DocumentStructure/SvgDocument.cs. So, it can safely live in that namespace, there is no need for a separate namespace. This could even be part of SvgDocument class, right?

[MarvinPogoda]

It is considerable to always deactivate dtdprocessing by default as suggested here:

Short version

More information

Package versions that use dtd-processing should be probably be marked as vulnerable.

[paulushub]

Package versions that use dtd-processing should be probably be marked as vulnerable.

We can add a custom DTD resolver, and turn off entity resolutions to external remote documents by default.
SVG documents do use the entities.

[MarvinPogoda]

Is it possible to get a published nuget version, that includes this workaround?

[paulushub]

Is it possible to get a published nuget version, that includes this workaround?

Let's make it Monday. Also hoping to find time and fix the issue this weekend.