Upgrade bundled Expat to 2.8.5 (e.g. for fix to vulnerability CVE-2026-93990)

[hartwork]

Please see blog post https://blog.hartwork.org/posts/expat-2-8-5-released/ for an overview and the change log at https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/Changes for details. Affects all alive branches of Python. Thank you!

Related: #156723 (predecessor for Expat 2.8.4)

CC @StanFromIreland

---

• CVE-2026-93990

• gh-157953: Update bundled Expat to 2.8.5 #157957
• [3.15] gh-157953: Update bundled Expat to 2.8.5 (GH-157957) #157998
• [3.14] gh-157953: Update bundled Expat to 2.8.5 (GH-157957) #157996
• [3.13] gh-157953: Update bundled Expat to 2.8.5 (GH-157957) #157997
• [3.12] gh-157953: Update bundled Expat to 2.8.5 (GH-157957) #157999