CVE-2024-35176: REXML contains a denial of service vulnerability

The vulnerability stems from inefficient parsing of quoted attribute values. The pre-patch code in baseparser.rb used a regex that required scanning the entire attribute value at once (.*? pattern), which becomes exponentially slower with many consecutive special characters. The commit replaced this with chunked reading via read_until, demonstrating the vulnerable pattern was in the regex-based attribute value extraction. The Source class modifications adding read_until and modifying read() show the original I/O handling contributed to the resource exhaustion issue. The added performance test validates the quadratic complexity problem in attribute parsing.