[DOC] Parse options doc

[BurdetteLamar]

What problem is this PR intended to solve?

Improvements to doc for XML::ParseOptions.

Have you included adequate test coverage?

N/A. All doc.

Does this change affect the behavior of either the C or the Java implementations?

No.

[flavorjones]

Thank you for opening this! I apologize for not having made time to review this yet. I will do so in the next few days!

[flavorjones]

Sorry it took so long to circle back on this PR. Thank you so much for the time you've invested!

[flavorjones]

This looks great! I rebased onto origin/main and made a few small whitespace changes to please rubocop and make sure it's indented consistently.

[flavorjones]

Thank you so much, @BurdetteLamar!

[nwellnhof]

@flavorjones Some additional notes from me:

• DTDATTR and DTDVALID imply DTDLOAD and are unsafe as well.
• SAX1 should probably not be exposed.
• NODICT should probably not be exposed.
• XINCLUDE, NOXINCNODE and NOBASEFIX are only used by the XML Reader and XInclude API.
• HUGE is safe these days.

[flavorjones]

@nwellnhof Thanks for the additional notes, either @BurdetteLamar or I will circle back on these docs and make some more changes.

Do you know offhand when HUGE became safe to enable? I'd like to enable it by default if Nokogiri is built with an appropriate version of libxml2.

[nwellnhof]

Do you know offhand when HUGE became safe to enable?

I'd say since CVE-2022-40303 was fixed, so 2.10 and later should be safe. The fix was backported to several older distros as well.

[nwellnhof]

I also finalized the design of new options for 2.14, so I simply leave this here:

• UNZIP: Enable decompression. This option has no real effect for now. The plan is that users who really need decompression start to add the option. At a later point, it will be required to enable decompression.
• NO_SYS_CATALOG: Don't use system catalogs when resolving DTDs or entities.
• CATALOG_PI: Enable oasis-xml-catalog PIs. This is a really obscure feature that should have never been enabled by default. I don't think your users need it.