Fix escape_once double-escaping hex-encoded entities

(This is a manual merge of #9102)
The hex escape sequence can be of any length
Add CHANGELOG for c803b90