expat: patch CVE-2019-15903 (from Debian, issue #68818)

I hope this URL will last for a few months, feel free to find better.

pkgs/development/libraries/expat/default.nix

···
       sha256 = "1i7bq9sp2k5348dvbfv26bprzv6ka1abf0j5ixjaff9alndm4f19";
       stripLen = 1;
     })
+    (fetchpatch {
+      name = "CVE-2019-15903.patch";
+      url = "https://sources.debian.org/data/main/e/expat/2.2.7-2/debian/patches/CVE-2019-15903_Deny_internal_entities_closing_the_doctype.patch";
+      sha256 = "0lv4392ihpk71fgaf1fz03gandqkaqisal8xrzvcqnvnq4mnmwxp";
+      stripLen = 1;
+      excludes = [ "tests/runtests.c" "Changes" ];
+    })
   ];
 
   outputs = [ "out" "dev" ]; # TODO: fix referrers