feat(guided remediation): add pom.xml writing

[michaelkedar]

Copying over the pom.xml patch writing functionality from osv-scanner.
It's quite complicated, so I've tried to make minimal changes.

One notable change is how the writing works with local parent POMs. It now always rewrites the local parent pom.xml files, even if there are no patches. The location of the written parent poms is now relative to the written root pom.xml. (e.g. If the original pom.xml was foo/root/pom.xml with parent foo/parent/pom.xml, writing the root to bar/root/pom.xml will write its parent to bar/parent/pom.xml). To facilitate this, the output is now a path to the new manifest, rather than an io.Writer

One issue is that io/fs is read-only. I've worked around this by reading from the FS and writing the files to a path on the system. Maybe this should use something like go-billy instead?

We've vendored encoding/xml to add missing support for writing self-closing tags. I think it may be better to move this to its own fork.