[DBMON-6479] Harden SQL Server XML plan parsing (#23382)

* Harden XML plan parsing

* Add changelog

* Avoid instantiating at module level for multi threaded use

* Fix formatting

Author: eric-weaver

sqlserver/changelog.d/23382.fixed

@@ -0,0 +1 @@
+Harden SQL Server XML plan parsing

sqlserver/datadog_checks/sqlserver/statements.py

@@ -236,7 +236,8 @@ def obfuscate_xml_plan(raw_plan, obfuscator_options=None):
     Obfuscates SQL text & Parameters from the provided SQL Server XML Plan
     Also strips unnecessary whitespace
     """
-    tree = ET.fromstring(raw_plan)
+    parser = ET.XMLParser(resolve_entities=False, load_dtd=False, no_network=True)
+    tree = ET.fromstring(raw_plan, parser=parser)
     for e in tree.iter():
         if e.text:
             e.text = e.text.strip()