EPUB 3.3 allows a reserved set of external identifiers to be included in resources now.

External entities are still forbidden in the internal subset.

See the pull request for this one, as the issue(s) got a bit out of hand.