Upgrade expat to 2.4.9

This [expat release](https://github.com/libexpat/libexpat/blob/R_2_4_9/expat/Changes) fixes CVE-2022-40674 - Heap use-after-free vulnerability in function doContent. Expected impact is denial of service or potentially arbitrary code execution.

Should be fixed in both 1.12 and 1.11 branches.