[3.13] gh-148441: Avoid integer overflow in Expat's CharacterDataHandler (GH-148904)

[3.13] gh-148441: Avoid integer overflow in Expat's CharacterDataHandler (GH-148904) #266471