Switch to using the XML 2 lastpass format

This has a common root element so the response doesn't need to be inspected
before knowing what java object to deserialize it into.

Required identifying as 'cr' instead of 'mobile'.
Use google-http-client instead of jersey-client

Uses google-http-client-xml instead of a custom DTO reader, which
uses the more efficient XmlPullParser instead of an intermediary Document
to parse the DTOs.

This removes the implicit dependency on the JAXB APIs and other javax.*
libs which are not available on android.