fix: what bandit and the remaining lint rules found

- WS-Management answers are parsed with defusedxml (new dependency,
  defusedxml>=0.7) with DTDs forbidden. The check for "<!DOCTYPE" in the raw
  bytes it replaces missed a DTD in a UTF-16 answer, which expat reads too;
  on plain HTTP (16992) anyone in the path can send one. An answer with a
  DTD in any encoding is now refused as no WS-Management answer, as a UTF-8
  one already was (B314, B405).
- xml.sax.saxutils only escapes the request envelopes, nothing parses with
  SAX (nosec B406).
- python -m napalm_amt.record fetches the landing page without certificate
  checks, as before: it sends no credentials and records what discovery
  sees, and AMT's certificate is self-signed unless one was provisioned
  (nosec B501). The driver itself still verifies by default (verify_ssl).

tests/test_wsman.py

@@ -214,6 +214,29 @@ def test_a_non_soap_error_raises():
             _transport(retries=0).get("AMT_GeneralSettings")
 
 
+_WITH_DTD = (
+    '<?xml version="1.0" encoding="{encoding}"?>'
+    '<!DOCTYPE Envelope [<!ENTITY a "aaaa">]>'
+    '<Envelope xmlns="http://www.w3.org/2003/05/soap-envelope"><Body>&a;</Body></Envelope>'
+)
+
+
+@pytest.mark.parametrize("encoding", ["utf-8", "utf-16"])
+def test_an_answer_with_a_dtd_is_refused(encoding):
+    """A DTD has no business in a WS-Management answer, in whatever encoding it comes."""
+    with responses.RequestsMock() as rsps:
+        rsps.add(responses.POST, URL, body=_WITH_DTD.format(encoding=encoding).encode(encoding))
+        with pytest.raises(WsmanError, match="no WS-Management answer"):
+            _transport(retries=0).get("AMT_GeneralSettings")
+
+
+def test_an_answer_that_is_no_xml_raises():
+    with responses.RequestsMock() as rsps:
+        rsps.add(responses.POST, URL, status=200, body=b"<Envelope><Body>")
+        with pytest.raises(WsmanError, match="HTTP 200"):
+            _transport(retries=0).get("AMT_GeneralSettings")
+
+
 def test_a_connection_error_is_retried_then_raised():
     with responses.RequestsMock() as rsps:
         rsps.add(responses.POST, URL, body=requests.ConnectionError("refused"))