Add support for XXE sinks via the libxml2 package for Parse/ParseString/ParseReader

• False negative reproduction: https://github.com/vulna-felickz/go-xxe/blob/1e437fccfe10b5901fe0948ba273e1ad340289ae/my-go-project/web/vulns/vulns.go#L20

Changes

• Introduce a new class LestratGoLibxml2XPathExpressionString to the XPath module in the go/ql/lib/semmle/go/frameworks/XPath.qll file.
• This class is designed to handle XPath expression strings used in the Parser API functions of the lestrrat-go/libxml2 package.
• The class identifies the function with the Parse% naming pattern within the github.com/lestrrat-go/libxml2/parser.Parser package and assigns the first argument of the function call as an instance of this class.
• Added changelog (view md)

Testing:

• Install depstubber at go/ql/test

PATH="$PATH:$GOPATH/bin" 
GO111MODULES=off go get github.com/github/depstubber
GO111MODULES=off go install github.com/github/depstubber

• Generate Stubs: depstubber -vendor github.com/lestrrat-go/libxml2/parser Parser New,XMLParseNoEnt
• Succeeds: go build ./...
• edges/nodes as expected in testresults