Added test for ampersands escaping

Catch by @ErikMinekus

Code:

```php
$code = new Decoda\Decoda('[url]http://milesj.me?a=b&c[/url]');
$code->defaults();
echo $code->parse();
```

Output:

```html
<a href="http://milesj.me?a=b&amp;c">http://milesj.me?a=b&c</a>
```

As you can see the ampersand is correctly encoded within attributes, but not inside the content.
Even though browsers render this correctly, it's not valid HTML.
Fixed ampersands escaping

Escape special chars in the block contents.

With this patch, PHP will not encode existing html entities.

Maybe will be better to add a charset cconfiguration to select the good one.