Golang encoding/xml: invalid characters in comments, processing instructions, or directives [1.22 backport]

@maceonthompson requested issue #68654 to be considered for backport to the next 1.22 minor release.

@gopherbot please open backport issues, this is a minor security issue.

Comment From: dmitshur

This backport issue has been in WaitingForInfo state because it's not actionable until the upstream issue has a resolution. Closing for now, it's easy enough to re-open or create new backport issues as needed.