Private XML parsing implementation

Users are reporting sporadic XML parsing failures. We should not depend on the StAX API/implementation in the JDK as it may be missing or buggy or incomplete. We should use a minimal XML stream parser instead; does not need to (and probably should not) conform to a JAXP API. Most JAXP features are not needed.

Look into license-compatible implementations from which we can legally copy code first.