[CVE-2020-27197] Avoid SSRF on parsing XML

[orsinium]

What

1. Avoid local file inclusion where it is possible when parsing XML.
2. Avoid SSRF when parsing XML.

How

1. Add alllow_url=False option for parse. If it is False, the function checks that the passed string has no URL scheme specified.
2. Add allow_path=True option for parse. If it is False, use etree.fromstring instead of etree.parse.
3. Explicitly specify the allow_path value for every call of parse.

Tests

Tests are included.

Links

Closes #246

[orsinium]

Tested on our staging environment, the fix seems to be working as expected.

[emmanvg]

Thanks for confirming the fix @orsinium.