Libxml2's "no security embargoes" policy