fix: what bandit and the remaining lint rules found

- WS-Management answers are parsed with defusedxml (new dependency,
  defusedxml>=0.7) with DTDs forbidden. The check for "<!DOCTYPE" in the raw
  bytes it replaces missed a DTD in a UTF-16 answer, which expat reads too;
  on plain HTTP (16992) anyone in the path can send one. An answer with a
  DTD in any encoding is now refused as no WS-Management answer, as a UTF-8
  one already was (B314, B405).
- xml.sax.saxutils only escapes the request envelopes, nothing parses with
  SAX (nosec B406).
- python -m napalm_amt.record fetches the landing page without certificate
  checks, as before: it sends no credentials and records what discovery
  sees, and AMT's certificate is self-signed unless one was provisioned
  (nosec B501). The driver itself still verifies by default (verify_ssl).

napalm_amt/record.py

@@ -107,7 +107,9 @@ def _landing_page(host: str, port: int, tls: bool, out: Path) -> None:
     """The page discovery fetches, without credentials, with its status line and headers."""
     url = f"{'https' if tls else 'http'}://{host}:{port}/"
     try:
-        response = requests.get(url, timeout=10, verify=False, allow_redirects=True)
+        # Recorded as discovery sees it: no credentials go out, and AMT's own certificate
+        # on 16993 is self-signed unless one was provisioned.
+        response = requests.get(url, timeout=10, verify=False, allow_redirects=True)  # nosec B501
     except requests.RequestException as exc:
         print(f"landing page: {exc}", file=sys.stderr)
         return