python3: upgrade to release 3.5.9

Fixes CVE-2019-9948 CVE-2019-9740 CVE-2019-10160 CVE-2019-16056
and expat CVE-2019-15903.

python-3.3.5-pyexpat-symbols.patch.1 fails to apply, and it's a
mystery why --with-system-expat is used everywhere but on MacOSX,
where 292af048ac disabled it for no
obvious reason, so try to remove the special case and get rid of the
patch.

Change-Id: I5ba4532eb6e7c2fb90daba95d132dcc7c9013d96
Reviewed-on: https://gerrit.libreoffice.org/83117
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@cib.de>

external/python3/ExternalProject_python3.mk

@@ -44,9 +44,7 @@ $(call gb_ExternalProject_get_state_target,python3,build) :
 
 else
 
-# this was added in 2004, hopefully is obsolete now (and why only intel anyway)? $(if $(filter SOLARIS-INTEL,$(OS)$(CPUNAME)),--disable-ipv6)
-
-# --with-system-expat: this should find the one in the solver (or system)
+# --with-system-expat: this should find the one in the workdir (or system)
 
 # create a symlink "LO_lib" because the .so are in a directory with platform
 # specific name like build/lib.linux-x86_64-3.3
@@ -68,7 +66,7 @@ $(call gb_ExternalProject_get_state_target,python3,build) :
 		$(if $(CROSS_COMPILING),--build=$(BUILD_PLATFORM) --host=$(HOST_PLATFORM)) \
 		$(if $(ENABLE_VALGRIND),--with-valgrind) \
 		--prefix=/python-inst \
-		$(if $(filter MACOSX,$(OS)),,--with-system-expat) \
+		--with-system-expat \
 		$(if $(filter AIX,$(OS)), \
 			--disable-ipv6 --with-threads OPT="-g0 -fwrapv -O3 -Wall", \
 			$(if $(gb_Module_CURRENTMODULE_DEBUG_ENABLED), \