The existing implementation of `esc_attr()` runs a jumble of regular expression
and other search passes over its input.

In this patch, if the site uses UTF-8, then an exploratory single-pass custom
parser is used to escape the attribute values.

In order to clarify the main loop of `_esc_attr_single_pass_utf8` I've moved the
named character reference lookup outside of the function and into a new high-performance
token set class dubbed `WP_Token_Set`. I created this class to retain the performance
perks brought by the optimized data format.

There are two lookup sets though because WordPress traditionally has its own custom
set based on HTML4, but I would like to see us allow everything that HTML5 allows,
including the common `'` so we don't have to keep writing `&WordPress#39;` (because
that doesn't stand out as clearly as the name does).

Performance in this change is even better than it was previously because I've removed
the substitutions from the lookup table and that removes both iteration and working
memory. In order to provide the reverse function, decoding these entities, it would
probably be best to create two separate tables, or add a fixed byte length and offset
value as a lookup into another table so that we can avoid reintroducing the double
crawling scan that we had before.