fix: ensure network and load_dtd are disabled in xml reading

[georgeRobertson]

TLDR of changes

Improve reading security of lxml XML readers.

• Set no_network is set to False to prevent network access against remote resources. Docs indicate this should already be set but couldn't fully confirm - so just set for 100% assurance.
• Also set load_dtd to False to disable dtd functionality as not used and can be dangerous to leave on. This was less clear in the docs as to whether it was on or off. This makes sure it's off.

What kind of changes does this PR introduce?

Tick all that apply

• fix: A bug fix. Correlates with PATCH in SemVer
• feat: A new feature. Correlates with MINOR in SemVer
• docs: Documentation only changes
• style: Changes that do not affect the meaning of the code (white-space, formatting, missing semi-colons, etc)
• refactor: A code change that neither fixes a bug nor adds a feature
• perf: A code change that improves performance
• test: Adding missing or correcting existing tests
• build: Changes that affect the build system or external dependencies (example scopes: pip, docker, npm)
• ci: Changes to CI configuration files and scripts (example scopes: GitLabCI)

Please check if the PR fulfills these requirements

• I have read and followed the Contributing guidance
• Docs have been added / updated
• Tests and Linting in the CI are passing
• Changes have been reviewed and approved by a Project Maintainer

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud