Use safe parsing function for test fixtures

[Changaco]

Resolves https://hackerone.com/reports/2467232. The unsafe parsing function is only called on files checked into the repository, so it isn't exactly fed untrusted data. However, I'm willing to consider this a valid vulnerability in light of the recent xz backdoor incident, because the files in question are big and generated automatically, so an attacker might have been able to sneak an exploit in there without me noticing.

Sadly there are other attack vectors, and mitigating them will require significantly more work. PyPI, the software distribution service used by Liberapay to download its dependencies, is unsafe in its design. Any malicious entity who gains the ability to upload packages to PyPI for one of Liberapay's dependencies would have a good chance of breaching Liberapay completely. Related issue: #1305.