[3.13] gh-156939: Fix xmlcharrefreplace() buffer overflow (GH-157109)

[3.13] gh-156939: Fix xmlcharrefreplace() buffer overflow (GH-157109) #296085