gh-156723: Update bundled libexpat to version 2.8.4

[StanFromIreland]

Considering this includes fixes for three CVEs marked as High severity, I'm tagging this as a release blocker.

Verification action passes: https://github.com/python/cpython/actions/runs/33410740425/job/99549376852?pr=156724

• Issue: Upgrade bundled Expat to 2.8.4 (e.g. for 4 security fixes) #156723

[miss-islington-app]

Thanks @StanFromIreland for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖

[bedevere-app]

GH-156731 is a backport of this pull request to the 3.15 branch.

[miss-islington-app]

Sorry, @StanFromIreland, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 287b7cffb79d443614be51b48eaf085d663aeecd 3.12

[bedevere-app]

GH-156732 is a backport of this pull request to the 3.14 branch.

[miss-islington-app]

Sorry, @StanFromIreland, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 287b7cffb79d443614be51b48eaf085d663aeecd 3.11

[bedevere-app]

GH-156733 is a backport of this pull request to the 3.13 branch.

[miss-islington-app]

Sorry, @StanFromIreland, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 287b7cffb79d443614be51b48eaf085d663aeecd 3.10

[bedevere-app]

GH-156785 is a backport of this pull request to the 3.12 branch.

[bedevere-app]

GH-156786 is a backport of this pull request to the 3.11 branch.

[bedevere-app]

GH-156787 is a backport of this pull request to the 3.10 branch.

[bedevere-bot]

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot aarch64 RHEL8 Refleaks 3.11 (tier-2) has failed when building commit d98834e.

What do you need to do:

1. Don't panic.
2. Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
3. Go to the page of the buildbot that failed (https://buildbot.python.org/#/builders/932/builds/59) and take a look at the build logs.
4. Check if the failure is related to this commit (d98834e) or if it is a false positive.
5. If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/#/builders/932/builds/59

Failed tests:

• test_httpservers
• test_typing

Failed subtests:

• test_large_content_length_truncated - test.test_httpservers.CGIHTTPServerTestCase.test_large_content_length_truncated

Test leaking resources:

• test_httpservers: memory blocks
• test_typing: memory blocks

Summary of the results of the build (if available):

==

Click to see traceback logs

Traceback (most recent call last):
  File "/var/lib/buildbot/worker/cstratak-RHEL8-aarch64/3.11.cstratak-RHEL8-aarch64.refleak/build/Lib/test/test_httpservers.py", line 906, in test_large_content_length_truncated
    res = self.request('/cgi-bin/file1.py', 'POST', b'x', headers)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/lib/buildbot/worker/cstratak-RHEL8-aarch64/3.11.cstratak-RHEL8-aarch64.refleak/build/Lib/test/test_httpservers.py", line 85, in request
    self.connection.request(method, uri, body, headers)
  File "/var/lib/buildbot/worker/cstratak-RHEL8-aarch64/3.11.cstratak-RHEL8-aarch64.refleak/build/Lib/http/client.py", line 1351, in request
    self._send_request(method, url, body, headers, encode_chunked)
  File "/var/lib/buildbot/worker/cstratak-RHEL8-aarch64/3.11.cstratak-RHEL8-aarch64.refleak/build/Lib/http/client.py", line 1397, in _send_request
    self.endheaders(body, encode_chunked=encode_chunked)
  File "/var/lib/buildbot/worker/cstratak-RHEL8-aarch64/3.11.cstratak-RHEL8-aarch64.refleak/build/Lib/http/client.py", line 1346, in endheaders
    self._send_output(message_body, encode_chunked=encode_chunked)
  File "/var/lib/buildbot/worker/cstratak-RHEL8-aarch64/3.11.cstratak-RHEL8-aarch64.refleak/build/Lib/http/client.py", line 1145, in _send_output
    self.send(chunk)
  File "/var/lib/buildbot/worker/cstratak-RHEL8-aarch64/3.11.cstratak-RHEL8-aarch64.refleak/build/Lib/http/client.py", line 1067, in send
    self.sock.sendall(data)
BrokenPipeError: [Errno 32] Broken pipe