[tokenizer] numeric entities are now decoded

TODO: attribute values aren't handled yet
[tests] added test case for numeric entities