Update vendored expat

Expat 2.2.9 is out, but we import 2.2.6. There was some issue with updating in !6340 (merged) that needs looked at.