Security: Hardening MJCF XML parsing against XXE attacks

[RinZ27]

Problem Description

The current implementation of MujocoXML in robosuite/models/base.py (and several other core modules) uses the native xml.etree.ElementTree for MJCF parsing. According to standard security practices and Python documentation, this library is susceptible to XML External Entity (XXE) and XML bomb attacks when processing untrusted input.

While internal models are generally safe, a framework designed for research often involves loading MJCF models from diverse sources. Hardening the XML parsing logic would significantly improve the security posture of robosuite.

Proposed Solution

Consider migrating core XML parsing to a more secure alternative, such as defusedxml. This library provides protection against common XML-related vulnerabilities while remaining a drop-in replacement for many ElementTree functions.

This change would:

1. Prevent potential data leakage from the user's filesystem via external entities.
2. Protect against denial-of-service (DoS) attacks caused by recursive entity expansion (XML bombs).

I'd be happy to contribute a PR for this if the maintainers agree on adding defusedxml as a dependency.