Message HTML is double-unescaped

### Steps to reproduce

Send a message containing this HTML:
```
literal & &

&

```
(message event JSON should look like:)
```json
"content": {
"body": "(whatever, doesn't matter)",
"format": "org.matrix.custom.html",
"formatted_body": "literal & &

&

",
"msgtype": "m.text"
},
```

### Outcome

The message should have literal instances of `&`, as that's what the HTML is written; it should look like:

But Element Web renders this as:

Also happens for things like `&lt;` (i.e. escaped `<`) rendering as `<`.

(the second unescaping appears to happen after HTML parsing, so this bug doesn't result in constructing HTML not originally in messages)

### Operating system

_No response_

### Browser information

_No response_

### URL for webapp

Both app.element.io and develop.element.io

### Application version

_No response_

### Homeserver

_No response_

### Will you send logs?

Yes