Switch to defusedxml for secure XML parsing in skills and evaluation harness

[RinZ27]

The current implementation uses the standard xml.etree.ElementTree to parse XML files from untrusted sources, such as Office documents (OOXML) processed by skills and user-provided evaluation files. This poses a potential risk for XML External Entity (XXE) attacks.

I noticed these vulnerable patterns while reviewing the codebase and decided to switch to defusedxml, which provides a secure drop-in replacement.

Changes:

• Added defusedxml to project dependencies in pyproject.toml.
• Updated mini_agent/skills/mcp-builder/scripts/evaluation.py to use defusedxml.etree.ElementTree.
• Secured OOXML validation logic in redlining.py for both DOCX and PPTX skills by replacing lazy imports with the secure alternative.
• Maintained all existing business logic and parsing behavior to ensure no regressions in functionality.

These improvements ensure the agent can safely handle malformed or malicious XML documents without compromising the underlying system.