fix: address XXE in JaxbIO parsing (#2313)

CWE-611: createUnmarshaller().unmarshal(Reader) lets the JAXB provider build its own SAX parser with default settings — external general entities, parameter entities, and DTD loading are not disabled.

Author: ge0ffrey

core/src/main/java/ai/timefold/solver/core/impl/io/jaxb/GenericJaxbIO.java

@@ -124,7 +124,7 @@ public GenericJaxbIO(Class<T> rootClass, int indentation) {
 
     public T read(Reader reader) {
         try {
-            return (T) createUnmarshaller().unmarshal(reader);
+            return (T) createUnmarshaller().unmarshal(parseXml(reader));
         } catch (JAXBException jaxbException) {
             throw new TimefoldXmlSerializationException(ERR_MSG_READ.formatted(rootClass.getName()), jaxbException);
         }