Cairosvg susceptible to billion laughs type attack

Hi,

I'm forwarding https://gitlab.freedesktop.org/cairo/cairo/-/issues/383 here:

> When I try to open a malicious SVG that is created using nested references it hangs the application. The sample test case is at https://unshorn.github.io/foo.svg Note that this url cannot be opened on the browser as it will also hang.
There are two sample inputs: https://unshorn.github.io/nested-pattern-crash.svg https://unshorn.github.io/deep.svg

Start by reproducing the hang with the linked nested-pattern-crash.svg and deep.svg samples, then trace how CairoSVG processes nested SVG references. The issue does not name implementation files or tests; done means the malicious inputs no longer hang the application and the behavior is covered by a regression test.

Written by the indexing model from the issue text.