escapeHtmlAttribute: Support U+0100 to U+FFFF

After this change, `helmet.escapeHtmlAttribute` works correctly for code points in the range from U+0100 to U+FFFF.

```js
helmet.escapeHtmlAttribute('☃');
// before this patch:
// → "&#x03;" which is incorrect
// after this patch:
// → "&#x2603;" which is correct
```

Support for astral symbols (U+010000 to U+10FFFF) is still missing, though. See #1.