fix unescape by optimizing hextable init and access

int size is reduced to 1 byte, table length is truncated to only
accessed bytes, and access is limited to only the hex digit characters
by replacing isalnum() with isxdigit() in cgi_unescape_special_chars().
This actually fixes a bug in decoding if one of the hex digits after the
'%' was another character than a to f!