Status of defusedxml and recommendation in docs

[gpshead (Gregory P. Smith)]

@tiran owns that package and is in the best position to comment.

The Python standard library XML libraries are long-term-stale and not likely to ever see improvements.