Update rule rule-node_xpath_injection.yml to reduce false positives

What does this MR do?

1. Updates rules/lgpl/javascript/xml/rule-node_xpath_injection.yml rule patterns to reduce false positives.
2. Adds testcases to verify.

What are the relevant issue numbers?

Addresses issue: gitlab-org/gitlab#461482 (closed)

Playground Link - https://semgrep.dev/playground/s/DbGDq

Does this MR meet the acceptance criteria?

• The test cases cover both positive and negative cases and are also annotated with appropriate semgrep annotations:
  • For positive cases: // ruleid: ...
  • For negative cases: // ok: ....
• Following metadata fields exist for the rule(s) added/updated in this MR:
  • owasp with both 2017 and 2021 mappings.
  • category: "security"
  • cwe
  • shortDescription
  • security-severity
• The message field is valid and contains a secure code example.
• Applicable license is mentioned in the rule if embedded/taken from external source.
• Relevant labels including workflow labels are appropriately selected.