Improve SGML character entity detection

  * Match only valid (looking) forms
  * Mark all other (unencoded) ampersands as INVALID
  * Rename STRING ruleset to ATTRIBUTE