Fix a number of safemode issues (#647)

[Crozzers]

This PR closes #647 by fixing a number of safemode issues.

Code spans in link text being escaped

Previously putting a code span in the text for a link would result in the <code> tags being generated but then sanitised. I fixed this by detecting code spans when we hash HTML spans and just allowing them through, since code spans have their own encoding process

[`example.com`](https://example.com)
# Before: <a href="https://example.com">&lt;code>example.com&lt;/code></a>
# After: <a href="https://example.com"><code>example.com</code></a>

Incomplete tags in code spans being encoded incorrectly

Anything that looked like an incomplete tag that was inside an inline code span was being encoded as an incomplete tag, which it shouldn't. Code spans have their own encoding method and this resulted in the contents being encoded twice and getting mangled.

I fixed this by checking for code spans when we hash incomplete tags and ignoring them for that step.

`C:\<folder 1>`
# Before: <code>C:\&amp;lt;folder 1&gt;</code>
# After: <code>C:\&lt;folder 1&gt;</code>

FencedCodeBlocks joined to lists in safe mode

* Item 1
* Item 2

```
// Some code
```

This one was to do with the flow of the program in safe mode. In normal mode we process FCBs before HTML blocks are hashed, which replaces the FCB with \n\n<hash>\n\n.
In safe mode we wait until after the hashing stage to process code blocks, which means it was being re-inserted without that extra whitespace padding. This would cause the FCB to be cuddled to the list item above it.

Fixed this by manually inserting those extra whitespaces in safe mode.

Enable escaping ampersands in escaped chars

Previously if a user wrote \&, we would output the same thing which would render in the browser as \&.
But if the user wanted to escape & so that it rendered in its plaintext form, that wouldn't work.

This PR fixes that by processing escaped ampersands properly.

Fix escaping HTML in safe mode

Previously in safe mode, \< would not escape HTML properly, and the backslashes would be included in the output.

This has been fixed

\<abc\>
# Before: \&lt;abc\&gt;
# After: &lt;abc&gt;

[nicholasserra]

Appreciate the work on this one, thank you!

[justanotheranonymoususer]

Thanks for the fixes. Some things weren't fixed, and some were regressed. See #660