Improve configuration of xmlinputfactory (#2294)

(cherry picked from commit bfee6d5)

Author: tballison

tika-core/src/main/java/org/apache/tika/utils/XMLReaderUtils.java

@@ -308,6 +308,8 @@ public static XMLInputFactory getXMLInputFactory() {
 
         tryToSetStaxProperty(factory, XMLInputFactory.IS_NAMESPACE_AWARE, true);
         tryToSetStaxProperty(factory, XMLInputFactory.IS_VALIDATING, false);
+        tryToSetStaxProperty(factory, XMLInputFactory.SUPPORT_DTD, false);
+        tryToSetStaxProperty(factory, XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
 
         factory.setXMLResolver(IGNORING_STAX_ENTITY_RESOLVER);
         trySetStaxSecurityManager(factory);