[2.7] closes bpo-38174: Update vendored expat library to 2.2.8. (GH-16346)

[benjaminp]

Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes..
(cherry picked from commit 52b9408)

Co-authored-by: Benjamin Peterson [email protected]

https://bugs.python.org/issue38174

[bedevere-bot]

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot AMD64 Windows7 SP1 VS9.0 2.7 has failed when building commit e73b93a.

What do you need to do:

1. Don't panic.
2. Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
3. Go to the page of the buildbot that failed (https://buildbot.python.org/all/#builders/26/builds/334) and take a look at the build logs.
4. Check if the failure is related to this commit (e73b93a) or if it is a false positive.
5. If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/all/#builders/26/builds/334

Summary of the results of the build (if available):

Click to see traceback logs

From https://github.com/python/cpython
 * branch            2.7        -> FETCH_HEAD
Reset branch '2.7'