[CVE-REQUESTED] Prevent attribute collision check DoS

[hartwork]

Attack payload generator (use responsibly) download: attribute_collision_check_payload.py

# python3 attribute_collision_check_payload.py 5
<!DOCTYPE d [
  <!ATTLIST e a0 CDATA "" a1 CDATA "" a2 CDATA "" a3 CDATA "" a4 CDATA "">
]>
<d/>

# python3 attribute_collision_check_payload.py 10000 | time ./xmlwf/xmlwf 

Count	Runtime unfixed	Runtime fixed
10,000	0.17s	0.03s
100,000	13.22s	0.24s
200,000	59.71s	0.49s
400,000	253.18s	1.04s

(from a rather slow machine)

CC @berkayurun

[carnil]

https://www.cve.org/CVERecord?id=CVE-2026-45186 is now assigned for this issue.