libxml2: add Debian patches to address CVEs