Add bandit, use to catch known vulnerable XML parsing (#28341)

* Add bandit to pre-commit and CI, use to catch known vulnerable XML parsing

* Use defusedxml instead of direct xml.etree to parse XML

* Move config to tests/bandit.yaml

azure-pipelines-ci.yml

@@ -50,6 +50,10 @@ stages:
         . venv/bin/activate
         pre-commit run flake8 --all-files
       displayName: 'Run flake8'
+    - script: |
+        . venv/bin/activate
+        pre-commit run bandit --all-files
+      displayName: 'Run bandit'
   - job: 'Validate'
     pool:
       vmImage: 'ubuntu-latest'