security/vuxml: Document expat vulnerabilities

libwww is also vulnerable because it has expat in its source tree.

Security: CVE-2016-9063
Security: CVE-2017-9233