MDL-73834 mod_lti: Don't load external artifacts, original behaviour

Summary:

- With PHP7, libxml_disable_entity_loader() was making those
  flags futile, and the DTDs were not being requested ever.
- With PHP8, the flags get precedence and requests for the
  DTD have started to happen.
- Those requests are not served by W3C (1 minute time-out).
- Those DTDs aren't used by anything in code (no entity
  replacement, no validation...)

Hence:
- Remove the flags so it will work the same in PHP7 and PHP8.
- Just to double ensure we don't want any remote loading
  to happen ever, add explicitly the LIBXML_NONET flag.

mod/lti/locallib.php

@@ -4398,7 +4398,7 @@ function lti_load_cartridge($url, $map, $propertiesmap = array()) {
     libxml_clear_errors();
 
     $document = new DOMDocument();
-    @$document->loadXML($response, LIBXML_DTDLOAD | LIBXML_DTDATTR);
+    @$document->loadXML($response, LIBXML_NONET);
 
     $cartridge = new DomXpath($document);