Harden XML parsing against XXE

[jbuncle]

Summary:

• centralize secure XML parser factory creation
• disable DOCTYPE declarations and external entity resolution
• enable secure transformer settings for XML serialization

Why:
DocumentBuilderFactory was being used with default settings while parsing remote SOAP responses. Hardening the XML factories reduces XXE and external resource loading risk.

Verification:

• relied on existing GitHub Actions validation for this repo