Consider replacing lxml by defusedxml

[fmigneault]

Resolves multiple attack methods through XML:
https://pypi.org/project/defusedxml/#python-xml-libraries

Replacement seems relatively straighforward
https://pypi.org/project/defusedxml/#defusedxml

[cehbrecht]

... I'm wondering why the security fix is not part of lxml itself.

[fmigneault]

My understanding is that, depending on the underlying c++ lib version used to build the python package, some settings are available/added to disable the processing of potentially "dangerous" items, but default values of these settings are not the sames across versions. Therefore the build environment for which you pull the package will cause different behaviours.

[fmigneault]

Same fix as pywps, OWSLib, Weaver should be applied here?