Code changes to use defusedxml to monkeypatch xmlrpc when installed.

Updated docs, tests.  Also added a warning log message if the xmlrpc
endpoint is called without the defusedxml module installed. Warning can
be disabled using an advanced configuration method.

CI testing does not install defusedxml, but does test with a possible
troublesome test case using xmlrpc. If defusedxml is installed on a system it
will test it for proper response to an xml bomb.

changeset:   8237:57325fea9982