Fix handling of hexadecimal escapes in escape_once

[cr7pt0gr4ph7]

This also aligns the behavior once again with current behavior of ActionView::Helpers::TagHelper#escape_once / ERB::Util::html_escape_once (which escape_once was originally based on).

Fixes #792 (That bug was closed because of an available fix, but the fix was never merged).