[3.15] gh-156939: Fix xmlcharrefreplace() buffer overflow (GH-157109)

[3.15] gh-156939: Fix xmlcharrefreplace() buffer overflow (GH-157109) #132294