Security: TransformerFactory without secure XML processing enabled (XXE / CWE-611)

## Summary
The `text/xml` MIME handler creates a `TransformerFactory` without enabling secure processing features, leaving it potentially vulnerable to XML External Entity (XXE) expansion attacks.

## Location
`core/src/main/java/org/eclipse/angus/mail/handlers/text_xml.java` — line 90

```java
TransformerFactory tf = TransformerFactory.newInstance();
// Missing: tf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
Transformer transformer = tf.newTransformer();
```

## Risk
- CWE-611: Improper Restriction of XML External Entity Reference
- CWE-776: Improper Restriction of Recursive XML Entity References (Billion Laughs)
- An attacker who can supply a crafted XML mail body could potentially trigger XXE or entity-expansion if this handler is used to parse/transform untrusted content
- Severity depends on whether the transformer is used to parse attacker-controlled XML vs. to serialize

## Suggested fix
```java
TransformerFactory tf = TransformerFactory.newInstance();
tf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
Transformer transformer = tf.newTransformer();
```

## Discovered by
Automated security scan (cognium-ai) of the OSS-Fuzz Java corpus, June 2026.

Start at core/src/main/java/org/eclipse/angus/mail/handlers/text_xml.java around line 90 and inspect how the TransformerFactory is configured before transformation. Enable the secure XML-processing settings described in the issue, then verify that the text/xml handler still transforms content without permitting external DTDs or stylesheets.

Written by the indexing model from the issue text.