Revert "expat: 2.6.4 -> 2.7.0"

[RossComputerGuy]

Reverts #390052

Failures with the perl XML-Parser package as tracked by cpan-authors/XML-Parser#104. Looks like upstream won't have a fix soon so let's unblock staging.

[vcunat]

Maybe we should at least pick the security fix?

[LordGrimmauld]

I am somewhat surprised this even breaks to expat, looking at expat changelog:
https://github.com/libexpat/libexpat/compare/R_2_6_4...R_2_7_0?short_path=115d571#diff-115d571f9761592c10d3f0ce13c1bc434602251946353daed410fba8c3b9daa7
The vast majority of changes are:

• github workflows (.github/*)
• documentation/changelogs/comments (2024->2025, http->https, actual changelogs)
• improvements to tests, fuzzes and overall coverage
• changes to the win32 part of the lib (shouldn't affect us, i think?)

The only relevant change in expat i can see is changes to the Cmake files. Apparently expat now depends on protobuf? However protobuf is also not listed in the inputs in expat. I am a little confused why this breaks at all, but will poke in a bit. Though i won't stop you from unblocking the channel.

[MisileLab]

Maybe we should at least pick the security fix?

Unfortunately, libexpat/libexpat#980 (comment) says security fix pr broke test.

[mweinelt]

Given that the next staging cycle is for 24.11 I'd say we wait for what happens in the upstream issue.

[MisileLab]

@RossComputerGuy can we use libexpat/libexpat#989 instead of downgrade?

[hartwork]

@MisileLab @RossComputerGuy FYI there will be Expat 2.7.1 with that pull request merged and included before Friday morning this week (28th) if things go forward as planned.

[vcunat]

We certainly won't manage to start a new all-rebuild window earlier than this weekend, so I expect that's it.

The only question is if we care what's on staging until that moment. (I'm fine with both: merging this PR or not for this interim.)