JS: Exclude patched libraries from xml-bomb sink

[Napalys]

Removed libxmljs and lxml from XML bomb sink list, as their underlying C library have been patched and are no longer vulnerable.

[Copilot]

Pull Request Overview

This PR updates XML bomb vulnerability detection by removing libxmljs and lxml from the list of vulnerable XML parsing sinks. The underlying libxml2 C library has been patched with entity reference loop detection that prevents XML bomb attacks, making these libraries no longer vulnerable to such attacks.

Key changes:

• Removed XML bomb vulnerability detection for libxmljs in JavaScript
• Removed XML bomb vulnerability detection for lxml in Python
• Updated test expectations to reflect the reduced number of detected vulnerabilities

Reviewed Changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
javascript/ql/lib/semmle/javascript/frameworks/XmlParsers.qll	Updated libxmljs parsers to only resolve external/parameter entities, not internal entities
python/ql/lib/semmle/python/frameworks/Lxml.qll	Removed XML bomb detection logic for lxml parsers with explanatory comment
javascript/ql/lib/change-notes/2025-07-15-xml-bomb-sinks.md	Added changelog entry documenting libxmljs changes
python/ql/lib/change-notes/2025-07-15-xml-bomb-sinks-python.md	Added changelog entry documenting lxml changes
Various test files	Updated test expectations and removed XML bomb alert comments