fix: set `resolve_entities=False` in `partition_xml` (#3088)
### Summary
Closes #3078. Sets `resolve_entities=False` for parsing XML with `lxml`
in `partition_xml` to avoid text being dynamically injected into the
document.
### Testing
`pytest test_unstructured/partition/test_xml.py` continues to pass with
the update.