Security: xml.etree.ElementTree used across 10 core modules — no XXE protection

During a security audit of pan-os-python, two findings were identified.

Finding 1: Unsafe XML parser (High)

xml.etree.ElementTree is used across 10 core modules with no defusedxml
replacement or defuse_stdlib() call anywhere in the codebase.

Affected modules:
base.py, firewall.py, network.py, panorama.py, policies.py,
objects.py, ha.py, plugins.py, userid.py, __init__.py

The library's purpose is parsing XML responses from live network devices.
Any attacker-influenced response (MitM, compromised appliance, rogue endpoint)
is processed without XXE or Billion Laughs protection.

Fix: replace import xml.etree.ElementTree as ET with
import defusedxml.ElementTree as ET in each affected module.
Drop-in compatible, no API changes required.

Finding 2: SHA-1 used for value hashing (Medium)

panos/base.py:3172 uses hashlib.sha1() with an inline comment
explicitly documenting the usage. SHA-1 has been cryptographically
broken since 2017.

Review the XML imports in base.py, firewall.py, network.py, panorama.py, policies.py, objects.py, ha.py, plugins.py, userid.py, and init.py, then inspect panos/base.py:3172 for the hashlib.sha1 use. Treat the two findings as separate work items and check the project’s existing tests after each change. Done means unsafe XML parsing is addressed across all listed modules and the SHA-1 finding has a documented resolution.