More XSS's in safe mode

Describe the bug

After the patches of #722, I manually found a simple bypass of the HTML entity regex, and ran the fuzzer again to find another HTML corruption.

To Reproduce

1. The browser decodes &#058 to : forming a javascript: protocol URL (entities can be prefixed with any amount of 0's).

[Click me](javascript&#058alert(origin))

<p><a href="javascript&#058alert(origin)">Click me</a></p>

2. Weird combination of syntax again resulting in raw HTML being output:

<x![](`<a
>`)><svg onload=alert(origin)![](`<a
>`)

<p>&lt;x<img src="code&gt;&lt;a
&gt;&lt;/code" alt="" />&gt;<svg onload=alert(origin)<img src="code&gt;&lt;a
&gt;&lt;/code" alt="" /></p>

Expected behavior

Safe HTML is output. Maybe use a proper HTML entity decoder to solve the first.

Debug info
Version of library being used: https://github.com/trentm/python-markdown2/commit/ba92f30e9101f485bfd6b2a3178908ee4a82da9f (latest master at time of writing)

Start by tracing safe mode handling for HTML entities and malformed link/image syntax; reproduce the two Markdown inputs in the issue against the referenced commit. Done means both cases render as safe HTML without executable protocols or raw event-handler markup.