escapeHtmlAttribute: Support U+0100 to U+FFFF

After this change, `helmet.escapeHtmlAttribute` works correctly for code points in the range from U+0100 to U+FFFF.

    helmet.escapeHtmlAttribute('☃');
    // before this patch:
    // → "&#x03;" which is incorrect
    // after this patch:
    // → "&#x2603;" which is correct

Support for astral symbols (U+010000 to U+10FFFF) is still missing, though. See #1.