fix: add types-defusedxml to dev deps — was installed locally but missing from pyproject.toml (#159)

types-defusedxml was installed in the local venv (mypy passed locally) but not declared in [dependency-groups.dev], so CI never installed it. This caused three mypy errors on xml_safe.py: import-untyped (x2) and no-any-return. Adding the stubs package closes the gap between local and CI.

Co-authored-by: Gabriel Cardona <gabriel@tellurstori.com>