Java: `java/xxe` doesn't cover public XML helper methods that parse caller-provided input

This looks like a gap in `java/xxe` around library-style XML helpers. If a public helper takes caller-provided XML as an `InputStream`, `String`, `Reader`, or `URL`, builds a `DocumentBuilderFactory` without XXE hardening, and then calls `newDocumentBuilder().parse(...)`, I wouldn't expect that to fall out of coverage.

CodeQL already seems to model the parser sink and the usual safe configs here, and it still finds other `java/xxe` results in the same codebase, so this doesn't look like a missing sink or a failed analysis. It looks more like these public parsing entry points are not treated as strong enough sources for this query. That's a pretty normal pattern in SDK helpers, XML utility classes, metadata loaders, and config parsers, where the trust boundary is the method parameter rather than a controller or request object.

The aws-sdk-android fix for CVE-2022-4725 is a good example: both `RegionMetadataParser.parse(InputStream)` and `XpathUtils.documentFrom(...)` were fixed by adding the standard `DocumentBuilderFactory` hardening.

Semgrep's `documentbuilderfactory-disallow-doctype-decl-missing` rule catches the same shape by reusing the existing parser-construction sink and checking for missing hardening, which makes this seem like a fairly local modeling issue.

My guess is that `java/xxe` could cover this by recognizing public parse helpers that feed caller-controlled XML directly, or through trivial wrappers, into the existing XXE sinks. I would expect the same hole to show up for similar helper methods built around `SAXParserFactory` and `XMLInputFactory` too.

```java
import java.io.InputStream;
import javax.xml.parsers.DocumentBuilderFactory;

class XmlHelper {
public static void parse(InputStream in) throws Exception {
DocumentBuilderFactory f = DocumentBuilderFactory.newInstance();
var b = f.newDocumentBuilder();
b.parse(in);
}
}
```

Bắt đầu với truy vấn java/xxe cùng sink xây dựng parser hiện có và mô hình hóa cấu hình an toàn. Kiểm tra độ bao phủ đối với các helper public truyền giá trị InputStream, String, Reader hoặc URL vào DocumentBuilderFactory.parse, sau đó so sánh với các entry point tương tự của SAXParserFactory và XMLInputFactory. Hoàn tất khi các test thể hiện được findings cho dạng helper được mô tả và các wrapper tầm thường mà không làm mất các kết quả hiện có.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.