[rzo1]

Hardening, no known issue behind it. Core now creates its JAXP factories through Apache Commons Secure XML (1.1.0, no runtime dependencies):

• jsoup.XPathFilter and parse.filter.XPathFilter use SecureXPathFactory.newDefaultInstance(). This pins the JDK's XPath implementation instead of whatever is registered on the classpath, and turns on secure processing (no extension functions, JDK processing limits). The expressions still run against the in-memory DOM, so results are unchanged.
• RegexURLNormalizer reads its rules file with SecureDocumentBuilderFactory.newDefaultInstance(), so external DTDs and entities are no longer fetched. Before, a rules file declaring an external DTD made the normalizer load no rules if the DTD could not be fetched. RegexURLNormalizerTest covers this; it fails on main.

Left out on purpose:

• parse.filter.LDJsonParseFilter and RobotsTags, removed in #158 remove the DOM-based LDJsonParseFilter and LinkParseFilter #2253.
• The hardened SAXParserFactory in the Tika ParserBolt, which already rejects any DOCTYPE and so is stricter than the library default. That file is also changed by Tika ParserBolt: apply the JSoupFilters to the documents parsed by Tika #2256, #2211 Migrate core to HttpClient 5 and preserve parsing behavior #2236 and #315 Adaptative URL filter to normalize URLs based on canonical tag  #2052.