bump xml_security dependency to 0.0.3