* Add bandit to pre-commit and CI, use to catch known vulnerable XML parsing * Use defusedxml instead of direct xml.etree to parse XML * Move config to tests/bandit.yaml