- support maxEntityCount
- support onDangerousProperty
- support maxNestedTags
- handle prototype pollution
- fix incorrect entity name replacement
- fix incorrect condition for entity expansion
-

…-gqv2-49f6) (#847)

Backport to the v4 maintenance line of the v5 fix for GHSA-gh4j-gqv2-49f6
(CVE-2026-41650). When a value placed in a comment node contains `-->`
(or `--`), or a CDATA node contains `]]>`, the builder emitted it verbatim,
so the value could break out of the comment/CDATA and inject arbitrary markup.

v5 addressed this in fast-xml-builder@1.1.5 (pulled in by 5.7.0). v4 keeps
the builder inline, so the same neutralization is applied directly:
- CDATA: `]]>` -> `]]]]><![CDATA[>` (lossless split)
- comment: `--` -> `- -`, trailing `-` -> `- ` (a comment cannot contain `--`)

Applied to both the default and preserveOrder builders, with tests.

Co-authored-by: greymoth <246701683+greymoth-jp@users.noreply.github.com>