HTML character references: escape text, decode as the WHATWG tokenizer does