escape_once doesn't ignore hexadecimal entities

```
{{ "&excl; &#x00021; &#33;" | escape_once }}
```

Outputs:

```
&excl; &amp;#x00021; &#33;
```

https://en.wikipedia.org/wiki/List_of_XML_and_HTML_character_entity_references
https://dev.w3.org/html5/html-author/charref
