Harden SVG XML parsing with defusedxml

[realproject7]

Closes #40

Summary

• use defusedxml for every runtime SVG parse
• keep stdlib ElementTree only for safe SVG construction and serialization
• add entity-declaration rejection coverage for public SVG parsing APIs

Verification

• ./.po/venv/bin/python -m pytest
• ./.po/venv/bin/python -m ruff check src tests
• git diff --check

Generated with Codex