Replace serde-xml-rs by quick-xml

As quickly mentioned in the dependency update issue, I'd personally replace the xml parsing crate. It would make cargo audit happy, and if wanted, it would allow getting rid of the enums which handle the possibly overlapping lists in the XML definitions, yes, of course at a potential cost... What do you think, should I proceed with a MR? And would you change xml APIs as well?