Add an XML parser security audit recipe

[Widthdom]

Found while dogfooding the locally built cdidx on branch codex/search-audit-issues-20260619.

Duplicate check: no open issue found for XML parser security audit recipe XmlReaderSettings DtdProcessing.

Evidence:

• src/CodeIndex/Indexer/Symbols/SymbolExtractor.BuildAutomation.cs:37 uses XmlReaderSettings with DtdProcessing.Ignore, which appears safe.
• There is no built-in recipe that helps future audits find XML parser settings quickly.

Problem:
XML parsing can be security-sensitive when DTD/entity handling or external resolution settings change. A recipe would make regressions easier to spot.

Acceptance criteria:

• Add a built-in search audit recipe for XML parser APIs and DTD/entity settings.
• Document expected safe settings in recipe notes.
• Add tests for recipe metadata and matching behavior.

[Widthdom]

Work started on branch fix-issue3787-3714-3731-3710-3694-3693-3670-3696.