Set load-external-dtd to false when loading xml files

[cherylking]

Check for places that load xml files and set the load-external-dtd flag to false.

One placed I identified already: XmlDocument.createDocument(File)

DocumentBuilderFactory f = DocumentBuilderFactory.newInstance();
f.setFeature("http://apache.org/xml/features/nonvalidating/load-dtd-grammar", false); 
f.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); 

[cherylking]

Also affected:

HttpPortUtil.getHttpPortFromConfigVariableXML
ServerConfigDocument.getDocumentBuilder
DevUtil.getOmitFilesList
ServerFeatureUtil.getServerXmlFeatures

Finally, both LMP and LGP have a bunch of tests that load XML files and should specify these flags. Just search for DocumentBuilderFactory.