[3.14] gh-156939: Fix xmlcharrefreplace() buffer overflow (GH-157109)

[3.14] gh-156939: Fix xmlcharrefreplace() buffer overflow (GH-157109) #132295