Decode non-BMP hex escapes in JSON

Fixes #13064.