Remove lxml (B320 & B410) from blacklist

[djbrown]

removes B320 (xml_bad_etree) and B410 (import_lxml)

fixes #767

[sigmavirus24]

In my opinion:

• We should do this
• We should add very clear notes to our changelog
• We should start pointing people away from defused XML as it's maintenance status means lxml is likely to be safer going forward

[djbrown]

I couldn't find any changelog files. @ericwb do you know what Ian meant?

[sigmavirus24]

My mistake. I thought we had one but I guess not

[djbrown]

@sigmavirus24 thank you for your reply! :)
I saw this project actually does have a nice changelog via GitHub release descriptions generated from PRs:
https://github.com/PyCQA/bandit/releases
I updated this PRs title to be more suitable for the changelog.
And I guess this change would require a minor version bump (currently 1.8.0 -> 1.9.0)
@ericwb @lukehinds is there anything else I may help with to get this merged?

[ericwb]

So when removing a rule, we should keep the documentation for historical reasons and denote that the plugin or test was removed. This is to prevent someone in the future accidentally reusing the same Bandit ID number, thus leading to a conflict.

As for the code for the test, we can disable is functionality but keep it in order to reserve the Bandit ID associated with it.

For example, see the following. Notice how we kept the docs and denoted that the plugin was removed in what version. Please follow this example.

https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b309-httpsconnection

https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b322-input

https://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b322-input

[djbrown]

thank you @ericwb for the review!
I made another commit, restoring the documentation and denoting the removal