Fix xmldom vulnerability, used by passport-twitter

[kdhttps]

xmldom lib has Misinterpretation of malicious XML input vulnerability which is used by passport-twitter

└─┬ passport-twitter@1.0.4
  └─┬ xtraverse@0.1.0
    └── xmldom@0.1.31 

we have 2 actions on this,

christian-hawk
all the way I see this, we can split in 2 situations then.

1. XXE vulnerability mitigation, if it impacts passport
2. discuss passport-twitter replacement due non-maintanence

About number 1, if it does not impact passport, we don’t need further action.
The tree is
passport-twitter@1.0.4 › xtraverse@0.1.0 › xmldom@0.1.31
Xtraverse used by passport-twitter is also from jared.
xmldom mitigated the vulnerability already on version 0.5.0 so according to semver there is no breaking change.

About number 2:
I have to check the project, but maybe a simple fork and force updating xmldom should do it.