expat: fix CVE-2022-25314

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in
copyString.

Backport patch from:
https://github.com/libexpat/libexpat/pull/560/commits/efcb347440ade24b9f1054671e6bd05e60b4cafd



CVE: CVE-2022-25314

Signed-off-by: Steve Sakoman <steve@sakoman.com>