Also switch to GitHub releases because it apparently not subject to
naive Expat security policies, making it more reliable. Expat only
parses trusted inputs in w64dk, and so is unaffected by security issues.
Updates are generally unnecessary. Unfortunately Expat's repository has
an unconventiontional tagging convention, and tags do not exactly match
the version, so the ARG will no longer work on its own, which is why I
had avoided its GitHub releases for so long.
0019476f03