switch to go vendoring

vendor/github.com/mattermost/xml-roundtrip-validator/README.md

@@ -0,0 +1,73 @@
+# xml-roundtrip-validator
+
+The Go module `github.com/mattermost/xml-roundtrip-validator` implements mitigations for multiple security issues in Go's `encoding/xml`. Applications that use `encoding/xml` for security-critical operations, such as XML signature validation and SAML, may use the `Validate` and `ValidateAll` functions to avoid impact from malicious XML inputs.
+
+## Usage
+
+### Validate
+
+```Go
+import (
+    "strings"
+
+    xrv "github.com/mattermost/xml-roundtrip-validator"
+)
+
+func DoStuffWithXML(input string) {
+    if err := xrv.Validate(strings.NewReader(input)); err != nil {
+        panic(err)
+    }
+    // validation succeeded, input is safe
+    actuallyDoStuffWithXML(input)
+}
+```
+
+### ValidateAll
+
+```Go
+import (
+    "strings"
+
+    xrv "github.com/mattermost/xml-roundtrip-validator"
+)
+
+func DoStuffWithXML(input string) {
+    if errs := xrv.ValidateAll(strings.NewReader(input)); len(errs) != 0 {
+        for err := range errs {
+            // here you can log each error individually if you like
+        }
+        return
+    }
+    // validation succeeded, input is safe
+    actuallyDoStuffWithXML(input)
+}
+```
+
+### CLI
+
+Compiling:
+
+```
+$ go build cmd/xrv.go
+```
+
+Running:
+
+```
+$ ./xrv good.xml
+Document validated without errors
+$ ./xrv bad.xml 
+validator: in token starting at 2:5: roundtrip error: expected {{ :Element} []}, observed {{ Element} []}
+$ ./xrv -all bad.xml 
+validator: in token starting at 2:5: roundtrip error: expected {{ :Element} []}, observed {{ Element} []}
+validator: in token starting at 3:5: roundtrip error: expected {{ Element} [{{ :attr} z}]}, observed {{ Element} [{{ attr} z}]}
+```
+
+## Go vulnerabilities addressed
+
+Descriptions of the Go vulnerabilities addressed by this module can be found in the advisories directory. Specifically, the issues addressed are:
+
+ - [Element namespace prefix instability](./advisories/unstable-elements.md)
+ - [Attribute namespace prefix instability](./advisories/unstable-attributes.md)
+ - [Directive comment instability](./advisories/unstable-directives.md)
+ - Any other similar roundtrip issues we may not know about