Recovery mode can produce invalid UTF-8

Parsing invalid UTF-8 in recovery mode can lead to invalid UTF-8 in the resulting document. This can cause problems like #235 (closed). Once this is fixed, we should consider to abort on invalid UTF-8 in xmlEncodeEntitiesInternal or xmlEscapeEntities when fuzzing, so that other cases of invalid UTF-8 can be detected.