Make escape_once respect hexadecimal references

Any reason hexadecimal references would be omitted? I’m assuming it was just an oversight when originally written.

---

The regex for escape once recognises decimal numeric character
references and character entity references, but not hexadecimal
numeric character references.

Add hexadecimal references to the regex.