chore: use defusedxml

[jbutler]

Issue #, if available:

Description of changes:

Why is this change necessary:

How was this change tested:

Any additional information or context required to review the change:

Checklist:

• [ ] Updated the README if applicable
• [ ] Updated or added new unit tests
• [ ] Updated or added new integration tests
• [ ] If your code makes a remote network call, it was tested with a proxy

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.