Change RestrictiveXamlXmlReader to use an allow list

- Removes the old deny list logic used by RestrictiveXamlXmlReader
- Provides an extensible (via registry) allow list mechanism

Ported from release/7.0 branch.
Fixes CVE-2022-41089.

Author: GrabYourPitchforks