Added defusedxml to parse untrusted XML data

[mstfbl]

This PR fixes an issue pointed out by Bandit w.r.t. using the xml library to parse untrusted data, by using defusedxml instead.

Bandit output:

>> Issue: [B314:blacklist] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
   Severity: Medium   Confidence: High
   Location: ./torchvision/datasets/voc.py:206
   More Info: https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b313-b320-xml-bad-elementtree

[fmassa]

LGTM, thanks!

type check is failing, can you fix it so that we can merge the PR?

[fmassa]

One possible solution to the type checking is to disable it for defusedxml, as was done for some other libraries like

vision/mypy.ini

Lines 63 to 65 in 9e5edbd

	[mypy-av.*]
	ignore_missing_imports = True

[mstfbl]

Thank you @fmassa for your reviews and for merging the previous PRs. I have added the mypy type check disable for the defusedxml package.

[fmassa]

Thanks!