It's in xonotic/data/xonotic-data.pk3dir/sound/misc/hit.wav in the git repo checkout. The releases have pk3 files, which are just renamed zip files. You can either unzip them, modify and zip again or keep them as unzipped folders with the pk3dir "extension".
There should be no issues with changing the sounds considering a lot of people seem to do it.
<packer> when i see martin-t's name my blood pressure increases
<
[BOT]Hоtdоg> anyone here lives near martin?
<
[BOT]Hоtdоg> will pay monies for shooting him