Fix lxml default parser

[cehbrecht]

Overview

This PR configures the lxml default parser to avoid security issues.

For example the default lxml parser replaces entities in the XML request with the content of local system files.

• https://lxml.de/parsing.html#parser-options
• https://pypi.org/project/defusedxml/#python-xml-libraries

Changes:

• Added xml_util.py with a configured lxml parser for lxml.etree.fromstring and lxml.etree.parse.
• Added test for xml_util.py.
• Adjust to werkzeug deprecation warnings:
  • use werkzeug.Response
  • use markupsafe
• Cleaned up imports.

Related Issue / Discussion

geopython/OWSLib#790

Additional Information

This PR is not using defusedxml.lxml since it is deprecated:
https://pypi.org/project/defusedxml/#defusedxml-lxml

Contribution Agreement

(as per https://github.com/geopython/pywps/blob/master/CONTRIBUTING.rst#contributions-and-licensing)

• I'd like to contribute [feature X|bugfix Y|docs|something else] to PyWPS. I confirm that my contributions to PyWPS will be compatible with the PyWPS license guidelines at the time of contribution.
• [x ] I have already previously agreed to the PyWPS Contributions and Licensing Guidelines

[coveralls]

Coverage remained the same at 0.0% when pulling 6896931 on cehbrecht:fix-lxml-parser into 7112197 on geopython:pywps-4.4.