xml security issue

https://github.com/tonyqus/npoi/commit/9f402aa5f0ee0fc7d77002c9d39d3a84d90a9ecb

https://docs.microsoft.com/en-us/dotnet/api/system.xml.xmlreadersettings.xmlresolver?view=netcore-3.1

An XmlResolver used to access external documents. If set to null, an XmlException is thrown when the XmlReader tries to access an external resource.

The default is a new XmlUrlResolver with no credentials. Starting with the .NET Framework 4.5.2, this setting has a default value of null.