Required to address reported in-the-wild CVEs in older Expats.
This may need a tweak for Linux / BSDs to set appropriate values in
our custom expat_config.h : only macOS and Windows tested so far.
Switch back to including the bundled expat sources directly in the
targets, since transitive linking of static libs is very awkward.
Makes static build happy again (let's see what else breaks)
Renamed bundled Expat headers to avoid any
possibility of accidental including system headers when
using bundled Expat, or vice-versa. Should help with SVN
crashes reported by Thomas.
