Improve SGML character entity detection

  * Match only valid (looking) forms.
    Don't blindly consume end of parent sequence.
  * Mark all other (unencoded) ampersands as INVALID
  * Rename STRING ruleset to ATTRIBUTE