Block one more gadget type (xalan2)

[cowtowncoder]

Another gadget (*) type report regarding a class of xalan.

Mitre id: not yet allocated
Reporter: @ybhou1993 (via #2462 originally)

• 2.9.10
• 2.8.11.5
• does not affect 2.10.0 and later

---

(*) See https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 for more on general problem type

[cowtowncoder]

Looks like this one is legit too, following similar pattern of creating JNDI context.