[audit] xml-rs → quick-xml (#10)

`xml-rs` [is not maintained](https://rustsec.org/advisories/RUSTSEC-2022-0048) anymore. It is apparently [currently being](netvl/xml-rs#221 (comment)) transferred, but even if that happens (which is not a given), `xml-rs` still appears to have a large backlog of unresolved issues. Looks like it's time to switch.

I found two crates that are actively maintained and can do SAX parsing:
  * [quick-xml](https://github.com/tafia/quick-xml). Clean codebase, no `unsafe`, lots of tests, lots of recent commits. Lots of dependencies as well, but fortunately all of them are optional except `memchr`, which I guess is OK. The API is similar to `xml-rs`, so migration is mostly straightforward.
  * [xmlparser](https://github.com/RazrFalcon/xmlparser). An absolute gem of a library: no dependencies at all, small and clean codebase, no `unsafe`. Unfortunately, the API doesn't group attributes together (the current geodata importer [relies](https://github.com/dfyz/osm-renderer/blob/87266a44464447be4951d4c244a7f85bc054e59c/src/geodata/importer.rs#L372) on that), and I don't want to make too invasive changes when switching.

So, `quick-xml` it is (for now). By the way, it really lives up to its name: importing Serbia now takes **01:08** minutes on my laptop, while it used to take **02:51** minutes.

Cargo.toml

@@ -12,9 +12,9 @@ indexmap = "*"
 memmap = "*"
 owning_ref = "*"
 png = "*"
+quick-xml = "*"
 stb_truetype = "*"
 tini = "*"
-xml-rs = "*"
 
 [dependencies.osmpbf]
 version = "*"