[3.11] Upgrade bundled libexpat to 2.6.0 (GH-115399)

[sethmlarson]

Backport of #115431 to 3.11 and prior (without changes to SBOM)

• Issue: Please upgrade bundled Expat to 2.6.0 (e.g. for the fix to CVE-2023-52425) #115399

[hartwork]

Verified using this Dockerfile, based on earlier version #98742 (review):

# Copyright (c) 2022-2024 Sebastian Pipping <[email protected]>
# Licensed under the Apache License version 2.0

FROM alpine
RUN apk add --update \
            diffutils \
            git \
            sed \
        && \
    git clone --depth 1 --branch 3.11 https://github.com/python/cpython cpython-3-11 \
        && \
    ( cd cpython-3-11 && git rev-parse HEAD ) \
        && \
    git clone --depth 1 --branch libexpat-2.6.0-3.11 https://github.com/sethmlarson/cpython cpython-pr \
        && \
    ( cd cpython-pr && git rev-parse HEAD ) \
        && \
    git config --global advice.detachedHead false \
        && \
    git clone --depth 1 --branch R_2_5_0 https://github.com/libexpat/libexpat libexpat_2_5_0 \
        && \
    git clone --depth 1 --branch R_2_6_0 https://github.com/libexpat/libexpat libexpat_2_6_0 \
        && \
    diff -r -u libexpat_2_5_0/expat/lib/ cpython-3-11/Modules/expat/ | tee 2-5-0.diff \
        && \
    diff -r -u libexpat_2_6_0/expat/lib/ cpython-pr/Modules/expat/ | tee 2-6-0.diff \
        && \
    sed -e '/^Only in /d' -e '/^\(+++\|---\) /d' -e '/^diff /d' -i 2-5-0.diff 2-6-0.diff \
        && \
    diff -u 2-5-0.diff 2-6-0.diff \
        && \
    echo 'Diff is good.'

[miss-islington-app]

Thanks @sethmlarson for the PR, and @ambv for merging it 🌮🎉.. I'm working now to backport this PR to: 3.8, 3.9, 3.10.
🐍🍒⛏🤖

[miss-islington-app]

Sorry, @sethmlarson and @ambv, I could not cleanly backport this to 3.9 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker e071b0d558b2f5cddd5a9fc6afadb4ba109ec77e 3.9

[bedevere-app]

GH-115473 is a backport of this pull request to the 3.10 branch.

[miss-islington-app]

Sorry, @sethmlarson and @ambv, I could not cleanly backport this to 3.8 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker e071b0d558b2f5cddd5a9fc6afadb4ba109ec77e 3.8

[sethmlarson]

@ambv 3.9 and 3.8 backports are available:

• [3.9] Upgrade bundled libexpat to 2.6.0 (GH-115399) #115474
• [3.8] Upgrade bundled libexpat to 2.6.0 (GH-115399) #115475

[bedevere-app]

GH-115473 is a backport of this pull request to the 3.10 branch.