Improve security by using defusedxml when installed in environment

[alorence]

This change was originally suggested by @atodorov, thanks to him for this contribution.

Currently, django-modern-rpc uses builtin xmlrpc.client.loads() function to parse incoming requests. But this can cause a security issue when an attacker send a valid but malicious XML-RPC request.

A Python package can help to mitigate this kind of attack, defusedxml (GitHub repo).

The goal of this PR is to implement defusedxml support in django-modern-rpc

Currently:

• defusedxml is added to extra dependencies
• defusedxml.xmlrpc.monkey_patch() is called from ModernRpcConfig.ready() when available
• 2 functional tests have been added to ensure
  • use of XML <!ENTITY key "value"> syntax in XML-RPC request is disabled and raise an exception on parsing step
  • the same payload can work when defusedxml.xmlrpc.monkey_patch() is not called, or when defusedxml.xmlrpc.unmonkey_patch() is called after project initialization

Remaining

• [x] Mention the change in the documentation
• [x] Improve comments and docstring, specifically around tests

Drawbacks

• Due to a limitation in the way live_server fixture has been customized for these tests, Django 2.1 cannot be supported anymore edit: this is not true anymore

[coveralls]

Pull Request Test Coverage Report for Build 8080878481

Details

• 6 of 10 (60.0%) changed or added relevant lines in 1 file are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage decreased (-0.5%) to 98.005%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
modernrpc/apps.py	6	10	60.0%
<!--	Total:	6	10	60.0%	-->

Totals
Change from base Build 8065652169:	-0.5%
Covered Lines:	737
Relevant Lines:	752

---

💛 - Coveralls

[alorence]

Thanks @atodorov for your feedbacks. I just implemented some of them, and renamed a few things. Some documentations and comments were also added. In addition, I updated the way tests are run around this change, and I dropped the need to define a custom live_server fixture. So basically, we do not need to drop Django 2.1 support anymore...