add opt-in to disable external DTD access in JAXPValidator - #331

this has been a conscious decision and even been documented as such, see the {release notes of 2.6.](https://github.com/xmlunit/xmlunit/blob/main/RELEASE_NOTES.md#xmlunit-for-java-260---released-2018-04-22)

I wouldn't be opposed to added a stronger warning to the class' javadocs - nor to adding SchemaFactorConfigurer and ValidatorConfigurer classes similar to org.xmlunit.util.DocumentBuilderFactoryConfigurer so disabling acces would be easier for people who want to disable it. We may as well do so with a new setting on JAXPValidator, but I really do not want to change the default here.

The context of the validation package is one where I strongly believe people will only use it on trusted inputs. And if they don't there are warnings already in place.

makes sense, the 2.6.0 note is clear and I don't want to change that default either. I've reworked this to leave the default alone and added an opt-in setDisableExternalDtdAccess(boolean) instead, plus a stronger warning in the class javadoc. The test now flips the flag on.

If you'd rather have reusable SchemaFactoryConfigurer/ValidatorConfigurer classes than a one-off setter, I'm happy to go that route instead, just say the word.

I'm fine with the one-off setter unless you believe there are other places in XMLUnit that would benefit from the configurer. I don't believe SchemaFactory or Validator are used anywhere else (outside of the legacy project), though.

agreed, the setter's the right scope here. JAXPValidator is the only spot outside the legacy project that touches SchemaFactory/Validator, so a shared configurer wouldn't really buy anything. thanks for merging.