chore(package): bump @xmldom/xmldom to ^0.9.0 and rollup to ^2.80.0 to fix security vulnerabilities

[Jerricho93]

Description

Fix security vulnerabilities in npm dependencies.

• @xmldom/xmldom was pinned at ^0.8.3 which is affected by multiple high/critical advisories (XXE injection and related XML parsing issues). Bumped to ^0.9.0 (currently resolves to 0.9.10). The only usage in this repo is DOMParser.parseFromString() + getElementsByTagName('parsererror'), which is fully compatible with the 0.9.x API.
• rollup was on a range that included versions <=2.79.2, which are affected by a DOM clobbering vulnerability (high severity). Bumped to ^2.80.0.

Related upstream issue: #189

Specific Changes proposed

• Bump @xmldom/xmldom from ^0.8.3 to ^0.9.0 in dependencies
• Bump rollup from ^2.38.0 to ^2.80.0 in devDependencies

Requirements Checklist

• Feature implemented / Bug fixed
• Unit Tests updated or fixed
• Docs/guides updated
• Reviewed by Two Core Contributors