GHSA-2g98-f9jv-w8c5: robrichards/xmlseclibs XPath injection

The vulnerability stems from unfiltered user input in XPath expressions. The pre-patch code in XMLSecEnc.php directly interpolated $id (from URI substring) into an XPath query, while XMLSecurityDSig.php's processRefNode built an XPath condition using $identifier and looped $idKey without sanitization. The commit introduced XPath::filter() to sanitize these values, confirming these were injection points. The functions' direct use of external inputs (URI-derived $id and signature reference $identifier/$idKey) in query construction without prior validation matches XPath injection patterns.