python 3.7 -- multiple vulnerabilities

Python changelog:

bpo-38243: Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering
the document page as HTML.
bpo-38174: Update vendorized expat library version to 2.2.8, which resolves
CVE-2019-15903.
bpo-37764: Fixes email._header_value_parser.get_unstructured going into an infinite
loop for a specific case in which the email header does not have trailing whitespace,
and the case in which it contains an invalid encoded word.
bpo-37461: Fix an infinite loop when parsing specially crafted email headers.
bpo-34155: Fix parsing of invalid email addresses with more than one @
(e.g. a@[email protected].) to not return the part before 2nd @ as valid email address.