This updates Expat to the latest release, 2.2.0, and applies the
upstream patch for a regression caused by the fix for CVE-2016-0718.

It's the same patch that I sent earlier in a patch for the master
branch.