Create xccdf ns always in some node, don't rely on nsDef workarounds