Implement `allowUnsafeSymbols` encoding option

Although `he.escape` allows for escaping "unsafe" markup characters,
there is currently no way to escape the inverse set--non-ASCII
characters only. This missing functionality is useful in contexts where
markup is allowed, but non-ASCII characters might be otherwise mangled
(as in the iframe `srcdoc` attribute, for example).

Introduce a new option to `he.encode` which disables the escaping of
unsafe markup characters. Preserve API compatability by disabling this
behavior by default.