core: Do not unescape XML input string.

If we unescape XML input strings, we turn escaped characters like
ampersand (`&amp;`) and greater-than (`&gt;`) or less-than signs
(`&lt;`) into their unescaped (raw) version, respectively `&`, `>` and
`<`. The XML parser then chokes on them because these characters are
not allowed outside CDATA sections. For example, we turn the correctly
escaped `<foo>2 is &lt;3</foo>` to the incorrect `<foo>2 is <3</foo>`.

The obvious fix is not to unescape input string. The XML parser will
take care of it. The same fix has been referenced here:
https://mail.python.org/pipermail/soap/2011-December/000696.html
Add requirements files, switch to Blease, fetch version from custom file.