when decoding numeric HTML entities, check if they're a number

According to php-src, strtol is pretty lenient with whitespace and other
non-numeric characters at the start of a string. Add the same checks
that exist there before attempting to process the numeric entity.

See:
https://github.com/php/php-src/blob/1e3e9e0bbbe073db4a32627e67e8f5d838852eaf/ext/standard/html.c#L802