expat: patch CVE-2015-1283 and CVE-2016-0718 (close #15561)

Note, CVE-2015-1283 is already patched in expat version 2.1.1 but, as
explained in the patch, the fix was insufficient.

pkgs/development/libraries/expat/default.nix

@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
 
   outputMan = "dev"; # tiny page for a dev tool
 
+  patches = [ ./CVE-2015-1283-refix.patch ./CVE-2016-0718-v2-2-1.patch ];
+
   doCheck = true;
 
   meta = with stdenv.lib; {