CI_Security::_decode_entity() to replace dangerous HTML5 entities

Related to issue #2771