[3.5] closes bpo-38174: Update vendored expat library to 2.2.8. (GH-16346)

[vstinner]

Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes.

(cherry picked from commit 52b9408)

https://bugs.python.org/issue38174

[vstinner]

@larryhastings: Hey, here is a fix for Python 3.5 for https://bugs.python.org/issue38174 :
"Security vulnerability in bundled expat CVE-2019-15903 (fix available in expat 2.2.8)"

cc @benjaminp

[vstinner]

The Visual Studio project files are modified to remove Modules/expat/loadlibrary.c which has been removed from libexpat 2.2.8. Well, this change is just a backport from the master branch.

[larryhastings]

I've asked Ned and Julien to look at the Sphinx failure on Travis CI. Hopefully one of 'em will sort it out.

[vstinner]

I've asked Ned and Julien to look at the Sphinx failure on Travis CI. Hopefully one of 'em will sort it out.

I created https://bugs.python.org/issue38339 to track this bug.

[vstinner]

I rebased my PR on top of the commit edd9bc9 to fix the doc job of Travis CI.

[bedevere-bot]

@larryhastings: Please replace # with GH- in the commit message next time. Thanks!

[larryhastings]

Thanks for the backport!