fix: pin xmlsec to fixed version

[daibhin]

Problem

I faced the dreaded xmlsec issue again:

Traceback (most recent call last):
  File "/Users/david/src/posthog/posthog/urls.py", line 66, in <module>
    from ee.urls import extend_api_router
  File "/Users/david/src/posthog/ee/urls.py", line 12, in <module>
    from .api import (
  File "/Users/david/src/posthog/ee/api/authentication.py", line 8, in <module>
    from social_core.backends.saml import (
  File "/Users/david/src/posthog/env/lib/python3.10/site-packages/social_core/backends/saml.py", line 10, in <module>
    from onelogin.saml2.auth import OneLogin_Saml2_Auth
  File "/Users/david/src/posthog/env/lib/python3.10/site-packages/onelogin/saml2/auth.py", line 14, in <module>
    import xmlsec
ImportError: dlopen(/Users/david/src/posthog/env/lib/python3.10/site-packages/xmlsec.cpython-310-darwin.so, 0x0002): Symbol not found: _xmlSecSoap11Ns
  Referenced from: <FB55F7FB-2934-375D-B4C2-63C84C87E6D4> /Users/david/src/posthog/env/lib/python3.10/site-packages/xmlsec.cpython-310-darwin.so
  Expected in:     <5FA7FE3A-5AE7-3DF0-BC15-A416F049836B> /opt/homebrew/Cellar/libxmlsec1/1.3.4/lib/libxmlsec1.1.dylib

Previous attempt #22000

Changes

The original tracking issue has now been resolved as of xmlsec/python-xmlsec#284

Following SAML-Toolkits/python3-saml#389 (comment), we can explicitly set a version of xmlsec so everything just works

We also need to upgrade lxml or we get the xmlsec.InternalError: (-1, 'lxml & xmlsec libxml2 library version mismatch') error. There are no breaking changes when upgrading to the latest version: https://lxml.de/5.0/changes-5.0.2.html

Does this work well for both Cloud and self-hosted?

Yes

How did you test this code?

No more errors when running locally