Component attribute values don't decode HTML entities #42

Summary

Attribute values on components written in Markdown are passed through as written, so HTML entities show up literally.

Steps to reproduce

<Callout Title="Tom &amp; Jerry" Text="Use &lt;Tabs&gt; for this." />

Expected: the callout reads "Tom & Jerry" and "Use for this."
Actual: the entities show literally: Tom & Jerry and Use <Tabs> for this. (Blazor escapes the value as text).

Where

src/ShellDocs.Markdown/RazorTagScanner.cs (attribute values) and SlotExtractor / PreviewParser, which turn them into component parameters.

Suggested fix

WebUtility.HtmlDecode string attribute values (not @(...) expressions) before they become parameters. Add tests for &, <, " and numeric entities.