Increase the version of xml-2-js in bubblewrap cli package to eliminate the vulnerability

We are using @bubblewrap/cli@1.19.1 which brings xml2js inside and our dependabot raised the issue below.

_The latest possible version that can be installed is 0.4.23 because of the following conflicting dependency:
@bubblewrap/cli@1.19.1 requires xml2js@^0.4.5 via a transitive dependency on parse-bmfont-xml@1.1.4
The earliest fixed version is 0.5.0._

_xml2js versions before 0.5.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited._

Releasing a newer version of bubblewrap/cli will help users to avoid this security concern.