Add linter for XML calls allowing external entities (including DTD)

[mschwager]

Per the Python documentation:

Changed in version 3.7.1: The SAX parser no longer processes general external entities by default to increase security. Before, the parser created network connections to fetch remote files or loaded local files from the file system for DTD and entities. The feature can be enabled again with method setFeature() on the parser object and argument feature_external_ges.

We should look for explicit enabling of the following features:

• xml.sax.handler.feature_external_ges
• xml.sax.handler.feature_external_pes

Enabling these features allows for XML XXE including DTD retrieval. We should detect usage of these features.