Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes..
(cherry picked from commit 52b94080)
Co-authored-by: Benjamin Peterson <benjamin@python.org>