Configuration to disable XSL transformations in XML signature verifications

W3C's 'XML Signature Best Practices' discusses some risks of XSL transformations in XML signature verifications, and suggests that implementations "may provide interfaces to allow the application to optionally disable support for it". (https://www.w3.org/TR/xmldsig-bestpractices/#xslt-denial)

This functionality has caused security issues in the past, see for example this is a related CVE: https://nvd.nist.gov/vuln/detail/CVE-2022-34169

Would you consider adding support to optionally disable XSL transformations in XML signature verifications? That would allow applications that don't use the feature to 'defend in depth' against mis-uses of the feature.

One potential approach would be to add a system property (for example `org.apache.xml.internal.security.transforms.implementations.TransformXSLT.enableXSLTInXMLSignatures`) that disables the functionality.