using --with-system-expat working when the system expat does not have
salted hash support.

Transplant from main repo d6c197edd99b: Fixes Issue #14234: CVE-2012-0876: Randomize hashes of xml attributes

These regex changes fix a number of issues for distutils on Windows:
- #6884: impossible to include a file starting with 'build'
- #9691 and #14004: sdist includes too many files
- #13193: test_filelist failures

This commit replaces the incorrect changes done in 0a94e2f807c7 and
90b30d62caf2 to fix #13193; we were too eager to fix the test failures
and I did not study the code enough before greenlighting patches.  This
time we have unit tests from the problems reported by users to be sure
we have the right fix.

Thanks to Nadeem Vawda for his help.

Patch by Francisco Martín Brugué

Closes #8033.