fix: stop double escaping in code blocks

[faisalahammad]

Fixes #286

Changes proposed in this Pull Request

• In render_block(), always run htmlspecialchars_decode() on the extracted code. Since 3.7.2 (PR Fix escaping when language is unknown #283) the decode was behind a language check, so Plain Text blocks (empty language) stayed escaped and got escaped a second time in the shortcode callback. A block with <foo> / bar & showed <foo> / bar & on the front end.
• Accept a bare <pre> tag when extracting the code. The block saves <pre> with no attributes, and the old pattern #<pre [^>]+>([^<]+)?</pre># required an attribute and also stopped at any < inside the code.
• Pin the code format to raw around shortcode_callback(). Block content is always raw at this point, but a post stored as encoded (code format 2) would make the callback strip tags instead of escaping once.

Testing instructions

1. Add a SyntaxHighlighter block, set language to Plain Text, enter <foo> and bar &.
2. Publish and view the post. Front end should show <foo> and bar & literally, not <foo> / bar &.
3. Check an older post with a SyntaxHighlighter block. It should render correctly again.
4. Check blocks with other languages and classic [sourcecode] shortcodes. Output should be unchanged.