expat: fix CVE-2022-25315

In Expat (aka libexpat) before 2.4.5, there is an integer overflow
in storeRawNames.

Backport patch from:
https://github.com/libexpat/libexpat/pull/559/commits/eb0362808b4f9f1e2345a0cf203b8cc196d776d9



CVE: CVE-2022-25315

Signed-off-by: Steve Sakoman <steve@sakoman.com>