🔒 fix: mitigate XXE vulnerability in XML BOM parser

[aman-katyal]

🎯 What: The vulnerability fixed
An XML External Entity (XXE) injection vulnerability was present in scripts/fetch_sourcing_bom.py due to the use of the standard library xml.etree.ElementTree parser for processing KiCad XML Bill of Materials (BOM) files.

⚠️ Risk: The potential impact if left unfixed
If an attacker could control the contents of the KiCad XML BOM file being processed, they could exploit the XXE vulnerability to perform Server-Side Request Forgery (SSRF), read local files on the system running the script (such as the CI server), or potentially cause a Denial of Service (DoS) through entity expansion attacks (billion laughs).

🛡️ Solution: How the fix addresses the vulnerability
The standard library xml.etree.ElementTree import was replaced with defusedxml.ElementTree. The defusedxml package is specifically designed to safely parse untrusted XML data by disabling the processing of external entities and DTDs by default, thereby entirely mitigating the XXE attack vector while maintaining API compatibility. Additionally, GitHub Actions workflow files (.github/workflows/devops-ci.yml and .github/workflows/run-kicad-ci.yml) were updated to install the new defusedxml dependency.

---

PR created automatically by Jules for task 10196404447633928831 started by @aman-katyal

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.