HPCC-8925 XMLDECODE decodes & to nothing

Various issues with the way XMLDECODE (and xml read) handle invalid escape
sequences.

1. XMLDECODE should be leave invalid escape sequences unchanged. At present
the unicode version strips them (sometimes) and the ascii version throws an
exception
2. Potential reads off the end of the input string in both cases
3. Incorrectly accepting upper-case variants of escape sequences
4. Unicode version was missing &nbsp. Strictly speaking that is an HTML escape
sequence not an XML one, but since the ascii version accepted it the unicode
one should too.

Signed-off-by: Richard Chapman <rchapman@hpccsystems.com>