XMLParser: a rejected file's valid includes stay registered #1282

Follow-up to #1266, which made XMLParser drop a document that fails to load.

The rollback works per document, not per load call. If main.xml includes sub.xml, sub.xml is valid and main.xml then fails (unknown node, bad attribute…), only main.xml is removed:

• the trees registered by sub.xml stay in the factory;
• sub.xml becomes the first document, so if it has its own main_tree_to_execute, a later createTreeFromText() of a file with several trees and no main_tree_to_execute silently runs that tree instead of reporting that the main tree is missing.

A related, older issue: when an <include> throws, current_path is not restored, so a later text <include> resolves relative to the failed include's directory. A partial loadSubtreeModel can also leave model entries behind.

Possible fix: make loadFromFile/loadFromText all-or-nothing by snapshotting opened_documents, tree_roots, tree_sources, subtree_models and current_path and restoring them on failure. That is a behaviour change: the trees of valid includes of a rejected file would no longer stay registered. Recording it here as a known limitation until someone hits it.