Fix integer truncation in libxml2 xmlEscapeText

Changing newSize from int to size_t prevents a 32-bit signed integer
truncation that could lead to an undersized allocation and a subsequent
heap-buffer-overflow.

A regression test was manually verified under ASAN to detect the bug (it
triggers a heap-buffer-overflow without the fix and passes with it).
However, this test is not included in the commit as it requires a ~2GB
allocation which could cause flakiness or OOMs on CQ bots with limited
memory.

Fixed: 506388321
Change-Id: Ic46cccfbeaad277bf38413901be5357801abd6e6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7794884
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Commit-Queue: Andrew Paseltiner <apaseltiner@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1621216}
NOKEYCHECK=True
GitOrigin-RevId: 240a66356280ba79aabb6dbe1d27e1b273b3750f