#359276 by lyricnz, Heine, Frando: Fix named entity handling in filter_xss(), so it does not clash with other entities and result in wrong encoding