Drop the redundant ACCESS_EXTERNAL_* attributes from the DOM and SAX
hardening paths: the deny-all EntityResolver floor already installed on
every DocumentBuilder and XMLReader blocks external DTD, entity, schema
and xi:include fetches in one place, so the JAXP 1.5 attributes add
nothing there. ACCESS_EXTERNAL_DTD stays on the transformer compile path,
where XSLTC copies it onto the reader it provisions for the stylesheet
and the floor does not reach.

Inline the now single-use JaxpSetters.trySetAttribute into
setOptionalAttribute(DocumentBuilderFactory), matching the other
setOptional* helpers, and update the hardener Javadoc accordingly.

Ported from copernik-xml-factory e5febc6.

Assisted-By: Claude Opus 4.8 (1M context) <[email protected]>

Replace the per-test temp-file fixtures with the shared leaked/ resources
and tighten the XInclude-awareness gate so the tests skip cleanly where
the platform refuses XInclude rather than failing.

Ported from copernik-xml-factory 2bbcb89.

Have the allow-list tests assert the resolver's exact in-memory content
is what lands in the parse result, proving the caller's resolver was
consulted rather than merely that the parse succeeded.

Ported from copernik-xml-factory 5d96ed6.

XSLTC copies the factory's ACCESS_EXTERNAL_DTD onto the reader it uses to
parse the stylesheet, but it does not touch that reader's deny-all
EntityResolver floor. HardeningTransformerFactory already routes every
stylesheet Source through an XmlFactories-hardened reader, so the floor
blocks the external-DTD/entity channel during stylesheet compilation on
its own, making the factory attribute redundant.

This was the last ACCESS_EXTERNAL_* setter in the hardening code: the
deny-all resolver floor now covers every DOM, SAX and TrAX external-fetch
channel. Verified against the full multi-JAXP suite, including
test-stockjdk running the trax tests against XSLTC.

Assisted-By: Claude Opus 4.8 (1M context) <[email protected]>