fix(security): replace vulnerable feed dependencies

[pushkart2]

Summary

• replace the vulnerable rss-to-json dependency chain with fast-xml-parser
• disable XML entity processing and bound feed fetches by timeout and response size
• update Discord REST dependencies to patched releases
• encode Google search terms as a single query parameter

Validation

• npm audit (0 vulnerabilities)
• npm run lint
• npm run build
• parsed the live Qbox Atom feed successfully
• git diff --check