Fix: xml: Correctly subtract xml with v1 patchsets

The recursive invocaion of subtract_xml_object(target_child, patch_child)
could free target_child. So xml_next(target_child) at the end of the
loop might not get the next child.