build(deps): bump xmlutil serialization to 1.0.1 and harden data layer parsers

[dkhawk]

Summary

• Dependency Update: Bump io.github.pdvrieze.xmlutil:serialization in gradle/libs.versions.toml from 0.91.3 to 1.0.1.
• XML DSL Migration: Migrate the XML {} configuration DSL in GpxParser.kt and KmlParser.kt by promoting isCollectingNSAttributes = true from defaultPolicy {} to the top-level XML {} builder per xmlutil 1.0.0+ DSL changes.
• KML Exception Hierarchy: Update expected exception for malformed KML coordinate tests in KmlParserTest.kt from XmlParsingException to XmlException per the updated xmlutil 1.0.x error hierarchy.
• Security Hardening (Coordinates): Enforce coordinate finiteness invariants in Coordinates (GeoJSON), LatLngAlt (KML), and Wpt (GPX) init blocks to prevent NaN/Infinity coordinate poisoning from reaching LatLng or LatLngBounds.Builder.
• Security Hardening (Styles): Sanitize non-finite numeric style properties (stroke-width, fill-opacity, stroke-opacity, width, scale) in GeoJsonMapper.kt and KmlMapper.kt to safe default visual styles rather than crashing or rendering invalid alpha/width values.
• Adversarial Test Suite: Add comprehensive SecurityHardeningTest.kt unit test suite covering adversarial coordinate poisoning and non-finite style attribute injection across GeoJSON, KML, and GPX formats.

Reviewers

• @kikoso
• @LoyalAbbas

Test Plan

• All 7 new adversarial unit tests in SecurityHardeningTest.kt pass cleanly.
• All existing parser unit tests in GpxParserTest.kt and KmlParserTest.kt pass cleanly.
• All 200 unit test tasks across all modules (:library, :clustering, :heatmaps, :data, :ui, :visual-testing) pass (./gradlew testDebugUnitTest).

[googlemaps-bot]

Code Coverage

Overall Project	42.99% -0.14%	🍏
Files changed	88.74%	🍏

Module	Coverage
data	49.12% -0.28%	🍏

Files

Module	File	Coverage
data	KmlMapper.kt	87.12%	🍏
	KmlParser.kt	85.71%	🍏
	GpxParser.kt	81.82%	🍏
	GeoJsonMapper.kt	80.61% -0.59%	🍏
	GeoJsonObjects.kt	80.3% -5.3%	🍏
	LatLngAlt.kt	80% -16.47%	🍏
	LatLngAltSerializer.kt	79.47% -0.66%	🍏
	GpxModel.kt	74.21% -2.78%	🍏

[kikoso]

I had to think for a millisecond what was "ele", not sure if it could be worth adding the entire name.

[kikoso]

LGTM

[dkhawk]

@kikoso Thanks for the feedback!

To address readability without breaking binary or source API compatibility for existing callers:

• Kept @XmlSerialName("ele") val ele: Double? = null in the Wpt primary constructor so positional/named arguments and .ele property access remain 100% backwards-compatible.
• Added val elevation: Double? get() = ele as a computed readability alias property on Wpt.
• Added comprehensive class and parameter KDoc to Wpt documenting ele as elevation in meters.
• Updated Wpt's init block validation check to use elevation == null || elevation.isFinite() so it is self-documenting.

[kikoso]

Ready to be merged IMO!