Skip the external-DTD tests where nothing may load one (#356)

The sdist job fails on `test_sign_and_verify_with_an_id_an_external_dtd_
declares`, added with the external-subset fix in 3a50b04 and never yet
through CI. Ubuntu 22.04 ships libxmlsec1 1.2.33 with the XXE patch
backported, and that xmlsec installs its no-XXE external entity loader
globally at xmlSecInit — so importing xmlsec refuses lxml its own
`load_dtd=True` parse, well before any shadow exists. libxml2 is matched
in that job (lxml is built with --no-binary), so the raw path is what
runs: no declaration is made, `#ext` resolves to nothing and the sign
fails. The test's premise, not its subject, is what the environment
removes.

Both tests that need a loaded subset now go through
`parse_with_external_dtd`, which skips when `docinfo.externalDTD` comes
back None — the same signal `PyXmlSec_LxmlDocumentSubsets` reads to
decide whether the copy should load one. Verified by hiding
tests/data/id_attr.dtd: 4 skips, no failures.

318 passed / 6 skipped on the mismatch build; 330 / 6 on the matched
static wheel, plain and with PYXMLSEC_FORCE_SHADOW=1.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: mxamin

tests/test_ds.py

@@ -108,8 +108,7 @@ def test_register_id_rejects_a_value_a_sibling_attribute_declares(self):
     def test_register_id_accepts_the_declared_attribute_beside_a_twin(self):
         """A second attribute repeating the value is not the declared one, so registering the declared one is the no-op."""
         xml = b'<!DOCTYPE Root SYSTEM "id_attr.dtd">\n<Root><Node ID="dup" other="dup"/></Root>\n'
-        root = etree.fromstring(xml, etree.XMLParser(load_dtd=True), base_url=self.path('doc.xml'))
-        xmlsec.SignatureContext().register_id(root[0], 'ID')
+        xmlsec.SignatureContext().register_id(self.parse_with_external_dtd(xml)[0], 'ID')
 
     def test_register_id_rejects_a_value_a_namespaced_registration_claimed(self):
         """Two attributes of one element differing only in namespace are two attributes: the second cannot win the lookup."""
@@ -288,9 +287,23 @@ def test_sign_and_verify_with_registered_id(self):
     # loads it knows "#ext" resolves to the Node (issue #356).
     EXTERNAL_DTD_XML = b'<!DOCTYPE Root SYSTEM "id_attr.dtd">\n<Root><Node ID="ext"><Data>signed</Data></Node></Root>\n'
 
+    def parse_with_external_dtd(self, xml):
+        """Parse `xml` with its external subset loaded, or skip the test when this build forbids that.
+
+        xmlsec installs a no-XXE external entity loader globally at
+        ``xmlSecInit`` (1.2.34 and later, and the patched 1.2.33 some
+        distributions ship), so merely importing xmlsec can refuse lxml its
+        own ``load_dtd=True`` parse. Nothing then types the id, on either
+        path, and there is no declaration left for the copy to carry across.
+        """
+        root = etree.fromstring(xml, etree.XMLParser(load_dtd=True), base_url=self.path('doc.xml'))
+        if root.getroottree().docinfo.externalDTD is None:
+            self.skipTest('this build refuses to load an external DTD subset')
+        return root
+
     def test_sign_and_verify_with_an_id_an_external_dtd_declares(self):
         """Should resolve a #id reference whose id attribute an external subset the caller loaded declares."""
-        root = etree.fromstring(self.EXTERNAL_DTD_XML, etree.XMLParser(load_dtd=True), base_url=self.path('doc.xml'))
+        root = self.parse_with_external_dtd(self.EXTERNAL_DTD_XML)
         sign = xmlsec.template.create(root, consts.TransformExclC14N, consts.TransformRsaSha1, ns='ds')
         root.append(sign)
         ref = xmlsec.template.add_reference(sign, consts.TransformSha1, uri='#ext')