Update lxml to 6.1.3, libxslt to 1.1.45 and libxml to 2.15.3

[javihern98]

Description

Updates the XML stack to the current security releases: lxml 6.0.2 → 6.1.3 (fixes CVE-2026-41066, XXE through iterparse() and ETCompatXMLParser), libxslt 1.1.33 → 1.1.45 (CVE-2024-55549, CVE-2025-24855, CVE-2025-7424, CVE-2025-11731) and libxml2 2.9.10 → 2.15.3. Closes #655.

Built on top of #650 (its two commits are included): libxslt 1.1.44+ requires libxml2 >= 2.15.1, so libxml goes to 2.15.3 rather than 2.14.6. The --with-lzma="no" flag is dropped because libxml2 2.15 removed LZMA support altogether (xzlib.c and the configure option are gone; 2.15.0 release notes: "The built-in HTTP client and support for LZMA compression were removed"). configure would only warn about the unknown option, and the wasm build never had LZMA since the old recipe disabled it, so nothing changes for users.

lxml gets -L$(WASM_LIBRARY_DIR)/lib -liconv. With the corrected --with-iconv="${WASM_LIBRARY_DIR}" from #650, libxml2 links GNU libiconv (libiconv_open), whereas the current 2.9.10 build silently uses musl's iconv_open because ${WASM_LIBRARY_DIR}/lib/include does not exist. lxml's setup.py links only -lxslt -lexslt -lxml2 -lz -lm, so without the flag lxml.etree fails to import with Dynamic linking error: cannot resolve symbol libiconv_open. libnetcdf's consumers may need the same flag once #650 lands.

Local build with the pyodide-build submodule, the 314.0.6 xbuildenv and Emscripten 5.0.3: libxml 22 s, libxslt 28 s, lxml 41 s; pytest --rt node packages/lxml passes (test_lxml[node], test_import[node-lxml]); on the stock 314.0.6 runtime etree.LIBXML_VERSION is 2.15.3 and LIBXSLT_VERSION 1.1.45, XPath/XSLT/EXSLT/objectify/html work, and iterparse() no longer resolves <!ENTITY ext SYSTEM "file:///..."> (the shipped 6.0.2 returns the file's content). The wheel grows from 1.64 MB to 2.15 MB because libiconv is now really linked in.

Type of change

• Adding a new package
• Updating an existing package
• Bug fix
• Other (please describe)