Quadratic run time when checking a start tag for duplicate attribute names

Unbounded namespace-declaration allocation in NsReader enables memory-exhaustion denial of service