remove unused pip requirements (bug 1027340)

https://bugzilla.mozilla.org/show_bug.cgi?id=1027340

r? @andymckay @robhudson
We used `defusedxml` for the IARC stuff. It's an optional requirement for DRF, IIRC.