Do not trust the schema the schema compiler is compiling

XSD2Java and its maven plugin exist to consume contracts written elsewhere, yet
parsed them with a bare DocumentBuilderFactory and let xs:include/xs:import
dereference whatever scheme the location named: a schema handed to a developer
could read local files, exfiltrate them through an external entity, or make the
build fetch internal URLs. DOCTYPE and external entities are refused now, and
locations resolve from the filesystem only unless -asl says otherwise. The check
is on the location after resolution against the base, since a relative include
under a remote base is remote too.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>