Add SAXReader sec features to match the defaults ...

In relevance to https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658
the default SAXReader contains the following features :

reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);