Switch to develop-2.9 reference

Update rebar.config

Point riak-erlang-client at dependency compatible with develop-2.9

Update rebar.config

XML External Entity attack

1. if HTTP API is exposed:

  - read any file on the system — via /search/extract, the error message leaks
    file content;

  - send HTTP «GET /» request to any host — by PUT/POSTing text/xml document,
    or via /search/extract.  This is also likely riak DoS if the host is
    attacker-controlled.

2. if PB API is exposed

  - send HTTP «GET /» request to any host — by PUT/POST, see above.

Example request:

<?xml version="1.0"?>
<!DOCTYPE meow [
  <!ENTITY xxe2 SYSTEM "/etc/passwd">
  <!ENTITY xxe1 SYSTEM "http://host/ping-me">
]>
<meow>&xxe1;</meow>

It doesn't check user-provided path in any way.
This allows overriding any file on the system with riak permissions.

Straighten security