CodeQL False Positive? java/xxe with javax.xml.transform.Transformer

CodeQL reports a "Resolving XML external entity in user-controlled data" alert for the following Java code. This appears to be a false positive.

Could the query be enhanced to recognise the following fixes applied to the javax.xml.transform.Transformer instance?

```import javax.xml.transform.*;
...

TransformerFactory factory = TransformerFactory.newInstance();
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); // fixes the vulnerability
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); // fixes the vulnerability
Transformer transformer = factory.newTransformer();
transformer.transform(source, result); /// wrongly (?) reports a java/xxe vulnerability
return result.getNode();
```

Also the following should/could be recognised as a fix?
```
...
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); // fixes the vulnerability where supported
Transformer transformer = factory.newTransformer();
```

CodeQL version: 2.7.6

See also: https://github.com/github/codeql/issues/7607