[3.14] gh-139313: Improve docs on XML security (GH-139460) (GH-141065)

Clarify that:
- it takes parsing for an attack
- that some doors are closed by default
- only Expat version 2.7.2 has all the fixes
- use of the bundle depends on configuration
(cherry picked from commit baa9f338971c6a13433a8232db77cd45e6b87b77)

Co-authored-by: Sebastian Pipping <sebastian@pipping.org>