Fix fast-xml-parser security vulnerability (#1546)

- Fixes
https://github.com/cursorless-dev/cursorless/security/dependabot/53

## Checklist

- [ ] I have added
[tests](https://www.cursorless.org/docs/contributing/test-case-recorder/)
- [ ] I have updated the
[docs](https://github.com/cursorless-dev/cursorless/tree/main/docs) and
[cheatsheet](https://github.com/cursorless-dev/cursorless/tree/main/cursorless-talon/src/cheatsheet)
- [ ] I have not broken the cheatsheet

Author: pokey

packages/cursorless-vscode/package.json

@@ -861,7 +861,7 @@
     "@types/vscode": "~1.61.0",
     "chai": "^4.3.6",
     "esbuild": "^0.17.11",
-    "fast-xml-parser": "^3.20.0",
+    "fast-xml-parser": "^4.2.4",
     "fs-extra": "11.1.0",
     "glob": "^7.1.7",
     "mocha": "^8.1.3"

packages/cursorless-vscode/src/scripts/preprocessSvgHats.ts

@@ -6,15 +6,17 @@ import * as path from "path";
 async function main() {
   const directory = path.join(getCursorlessRepoRoot(), "images/hats");
 
-  const dumper = new parser.j2xParser({
+  const dumper = new parser.XMLBuilder({
     ignoreAttributes: false,
-    supressEmptyNode: true,
+    suppressEmptyNode: true,
   });
 
   readdirSync(directory, { withFileTypes: true }).forEach(async (dirent) => {
     const filePath = path.join(directory, dirent.name);
     const rawSvg = await fsp.readFile(filePath, { encoding: "utf8" });
-    const svgJson = parser.parse(rawSvg, { ignoreAttributes: false });
+    const svgJson = new parser.XMLParser({ ignoreAttributes: false }).parse(
+      rawSvg,
+    );
 
     svgJson.svg["@_width"] = "1em";
     svgJson.svg["@_height"] = "1em";
@@ -27,7 +29,7 @@ async function main() {
     }
 
     const outputSvg = dumper
-      .parse(svgJson)
+      .build(svgJson)
       .replace(/fill="[^"]+"/, `fill="#666666"`)
       .replace(/fill:[^;]+;/, `fill:#666666;`);