[knroy]

Fixes go-xmlsec's second report against v2.1.0. There is no API change, so this ships as v2.1.1.

#	Item	Result
1	Large text cost up to 3.1x to parse	Exact buffer growth, and a hand-off only when no later value wants the buffer. 1 MiB 3.10 -> 1.12x, 2 MiB 1.45 -> 1.06x, 10 MiB 1.87 -> 1.08x. Eight 3 MiB values 1.33 -> 1.30x.
2	c14n.ParsePrefixList was quadratic	It now uses a map. 1 MiB of prefixes takes about 0.02 s instead of 10.9 s. Recorded as the twentieth security pass.
3	XPath per-evaluation costs	c14n reuses one namespace-axis map (4,016 -> 18 allocations for 2,000 elements). scopeSlots does one stable sort (4 -> 1 allocation). Deferred: the compat-mode context copy needs a context-side setter, which is new API (docs/known-gaps.md). WithFocus/EvalBool was dropped, because what remains is specific to each expression.
4	/r/l[1] built every child	A step stops at an integer-literal first predicate.
5	Many attributes, 20-22x peak	Duplicates are found by sorting past 8 attributes, and no name index is built for such a tag. 800K attributes: 21.5 -> 12.8x peak. The same first duplicate and message are reported.
6, 7a	Many namespace declarations, 13-15x peak	One scope index serves both lookups, and repeated URIs are interned. 100K declarations: 16.5 -> 6.6x peak.
7b	c14n size-estimate slack	Dropped: on real DocBook the estimate averages 0.96x the output, so tightening it would cause more extra copies.

Verification

• Each fix has a regression test that fails when the fix is reverted; 10 new tests (2,960 in total).
• Every lane ran its suites at the recorded marks. XSpec reads 224 in a worktree, the known path effect.
• tests/check.sh on this branch.