Bump multi_xml dependency to 0.5.2 for CVE-2013-0175 fix

See sferik/multi_xml#34 for details.