Fix escaping for non-admin authored posts

[yscik]

Fixes #159
Includes #182

Changes proposed in this Pull Request

• Change shortcode escaping to html encoding, run after htmlspecialchars
• Decode all HTML special characters to prevent double encoding

Testing instructions

• Create a post with a non-administrator user
• Add a Syntaxhighlighter block, with various code examples, and valid shortcodes, like this:

<?php echo 'Hello World'; ?> 

[gallery id="123" size="medium"] xxx [/gallery]
 
https://www.youtube.com/watch?v=21X5lGlDOfg

• Publish & view on frontend. Ensure characters are displayed correctly.

[jom]

I think this fixes the issue and seems to be okay for other things.

One side-effect I've seen of our oembed escape fix is that those URLs are not clickable, but that seems worth the tradeoff and probably quite rare.