Lock xmlbuilder to satisfy Azure name limit

This will be at a top to satisfy nested deps of xml2js