[SECURITY] Move from xml to defusedxml for XML parsing

[fabianegli]

XML is not save to parse in its original specification. See the official official Python builtin xml documentation which promotes the use of the defusedxml package. Pyre in the CI of this repo is complaining about it, too.

The reason why this is important is because we can not know whether or not the XML files a user parses is benign or not. We should protect our users from known security vulnerabilities.

[ypriverol]

#148 this will be tackling the issue.