[Task]: Disable external entity resolution by default in the XSD Validator transform and action

### What needs to happen?

XSD validation resolves external entities unless explicitly turned off. The
default comes from `ALLOW_EXTERNAL_ENTITIES_FOR_XSD_VALIDATION_DEFAULT`, which
is `"true"` in both places it is defined:

- `transforms/xml/.../xsdvalidator/XsdValidatorMeta.java:62` (XSD Validator transform)
- `actions/xml/.../xsdvalidator/XsdValidator.java:76` (XSD Validator action)

Both have the hardened configuration already implemented — a secure
`SchemaFactory`, `disallow-doctype-decl`, external general and parameter
entities off, and a rejecting entity resolver (transform:
`XsdValidator.java:137-168`, action: `XsdValidator.java:135-166`). In both it is
gated behind the flag being false, so with the current default it never runs and
the unsecured `SchemaFactory` is selected instead.

The fix is therefore the default value, not the implementation: change both
constants to `"false"`.

### Issue Priority

Priority: 2

### Issue Component

Component: Transforms