allow control codes in json passed to the decoder

a malicious actor can introduce the same codepoints via \uXXXX
escapes and they are not dangerous in erlang binaries regardless