package_managers.py uses ET.ElementTree against untrusted data

The [python docs](https://docs.python.org/3.8/library/xml.etree.elementtree.html) mention:
> **Warning**
>
> The xml.etree.ElementTree module is not secure against maliciously constructed data. If you need to parse untrusted or unauthenticated data see XML vulnerabilities.

This is used in line 265 here:
https://github.com/nexB/vulnerablecode/blob/369897fb947584e44581df075c6e76638737f2ca/vulnerabilities/package_managers.py#L250-L266

The [docs further suggest](https://docs.python.org/3.8/library/xml.html#the-defusedxml-package) to use [defusedxml](https://pypi.org/project/defusedxml/) instead:

> defusedxml is a pure Python package with modified subclasses of all stdlib XML parsers that prevent any potentially malicious operation. Use of this package is recommended for any server code that parses untrusted XML data. The package also ships with example exploits and extended documentation on more XML exploits such as XPath injection.