[SECURITY] XML entity expansion

Remote XML entites can be loaded in places where TYPO3 expects
only local files to be fetched. All places are changed so
the option to load entities is disabled.

Resolves: #61269
Releases: master, 7.6, 6.2
Security-Commit: 736a7ef0823893047843c6a7f5e72b220bfd4697
Security-Bulletins: TYPO3-CORE-SA-2016-005, 006, 007, 008
Change-Id: I26701fc2ffb5aed7ccbd96c168aef571d012091e
Reviewed-on: https://review.typo3.org/46834


Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: Oliver Hader <oliver.hader@typo3.org>