MFV: expat 2.6.3

[ngie]

Summary

The 2.6.1 - 2.6.3 releases address several security issues with the
library.

The release notes for the 2.6.1-2.6.3 releases can be found at
https://github.com/libexpat/libexpat/blob/R_2_6_3/expat/Changes .

Merge commit '8e1eae2319cd3a651941c88b46d95e8ee8507c6c'

MFC after: 1 week

[delphij]

I only looked into lib/{expat.h,internal.h,siphash.h,xmlparse.c} and these looks fine.