Add linter for insecure xmltodict use

[mschwager]

The xmltodict library is a widely used XML parsing module. We should check for insecure use of this library. A couple checks come to mind:

• The most obvious, and easiest, would be checking for falsey values in the disable_entities kwarg.
• A more interesting and in-depth check would be checking if defusedexpat is installed. The library checks for this like so:

try:
    from defusedexpat import pyexpat as expat
except ImportError:
    from xml.parsers import expat

This means if it's not installed then the library is wide open to various XML attacks similar to those prevented in defusedxml. Further, the defusedexpat library itself appears to be unmaintained, so there may be some insecurities we could search for there as well.