tools/expat: fix PKG_CPE_ID