test(xcatd): cover XML external-entity suppression

The test sends a document whose external SYSTEM entity points at a secret file.
It exercises both parser paths: the modern XML::Simple path and the older
compatibility path. Each path must parse the document, replace the entity with
its system identifier, and not read the file contents.