unescapeXML decodes any numeric entity, not just a whitelisted set
unescapeXML decodes any numeric entity, not just a whitelisted set

This allows unescapeXML to correctly parse strings like &#64; (@) and
complex sequences like &#x1f40d; (U+1F40D, Snake).

node-xmpp/ltx