harden(a11oy): mirror killinchu #150 bandit HIGH fix (MD5 usedforsecurity, XML-RPC defusedxml) — byte-identical shared modules

chore(sync): mirror backend .py + Dockerfile to Space (hf-sync-backend)