Golang encoding/xml: invalid characters in comments, processing instructions, or directives [1.23 backport]

@maceonthompson requested issue #68654 to be considered for backport to the next 1.21 minor release.

@gopherbot please open backport issues, this is a minor security issue.

Comment From: dmitshur

Re-targeted this cherrypick issue to track the backport to Go 1.23. (Go 1.21 is now outside of its support window and won't have further minor releases.)

Comment From: dmitshur

This backport issue has been in WaitingForInfo state because it's not actionable until the upstream issue has a resolution. Closing for now, it's easy enough to re-open or create new backport issues as needed.