Update Xalan dependency to 2.7.2

Use the latest Xalan version that fixes a security issue:
https://xalan.apache.org/xalan-j/readme.html#done

Even if the issue does not directly affect us, we must use the latest version and not trigger alarms from security scanners.