Fix KMLReader XML parser security hole

[dr-jts]

Fixes teh KMLReader usage of XML parser to avoid exposure to the XXE security hole.

The original report said:

We discovered that there’s lack of hardening for XXE for the KMLReader (jts-core).

Problem: The class initialises its XMLInputFactory via XMLInputFactory.newInstance() at field declaration (modules/core/src/main/java/org/locationtech/jts/io/kml/KMLReader.java and never sets SUPPORT_DTD or IS_SUPPORTING_EXTERNAL_ENTITIES. None of the four public constructors accept a caller-supplied factory either, so a consumer cannot harden it from outside.

Impact: This leads to an XXE vulnerability in a project depending on the KMLReader.

Potential fix: KML geometry has no legitimate use for DTDs or external entities, so this should not change behaviour for valid input.