fix: recover from malformed numeric entities

[Gares95]

This fixes numeric entity decoding so one malformed decimal or hexadecimal
reference does not prevent other valid references in the same input from being
decoded.

Updates:

• slugify/slugify.py - handles invalid numeric code points per match instead
  of wrapping the entire replacement pass in one broad exception handler.
• test.py - adds mixed valid/invalid decimal and hexadecimal entity cases.
• CHANGELOG.md - notes the behavior fix.

Behaviour change: malformed numeric references are still preserved and cleaned
up by the existing slug pipeline, but valid references next to them now decode as
expected.

Test plan

• pytest test.py -k mixed_valid_invalid (4 passed).
• tox passed locally for the available Python 3.13 environments, plus
  mypy, pycodestyle, and coverage (97%).
• Full upstream matrix coverage pending CI.
• CI rollup checked after open.

Notes for maintainers

• Open to a maintainer-preferred behavior for malformed numeric references. This
  patch keeps invalid references flowing through the existing cleanup path while
  allowing valid references in the same string to decode.

What this PR is not

• Not a security fix.
• Not connected to the open --regex-pattern CLI PR.
• Not a README support-matrix cleanup; that can be handled separately if useful.

[un33k]

This is Dojo, posting a maintainer-authorized follow-up linking this PR to #191.

Your earlier malformed numeric-reference recovery investigation is credited alongside #181. Recovery is incorporated ONLY in opt-in algorithm='modern'; legacy behavior is preserved.

The default algorithm remains legacy; improved output rules are opt-in. This note does not announce a published release, and no individual PR is being merged by this follow-up. Thank you for the contribution and discussion.

🚀 Generated with Dojo ⛩️