fix: Allow internal DTD/entities in FVDL parsing while still blocking external XXE

[jmadhur87]

processAuditFvdl() blocked all DOCTYPEs (SUPPORT_DTD=false), breaking FPRs with internal-only entities. Now allows DTD parsing but blocks external entity resolution (IS_SUPPORTING_EXTERNAL_ENTITIES=false), keeping XXE protection while fixing the parsing failure.

[rsenden]

According to Copilot:

---

Why the test failed:

• The exception is due to setting XMLConstants ACCESS_EXTERNAL_DTD on a StAX XMLInputFactory implementation that does not recognize that property.
• That property is not portable for XMLInputFactory across runtimes/providers.
• audit.fvdl contains no DOCTYPE or ENTITY declarations.

---

So, the proposed fix seems incorrect; it still sets the unsupported property, and unnecessarily allows DTD parsing. I've already pushed an alternative fix.