JSONML decodes text entities twice with keepStrings enabled

[Mahmoodifar]

JSONML decodes text nodes twice when keepStrings is enabled. Attributes and the default mode decode the same input once.

Reproduced on release 20260814 and current master (874673575807723d58bbec9ff1985668742940ce), with Java 17.0.20:

import org.json.JSONML;

String xml = "<p title=\"&amp;lt;\">&amp;lt;</p>";
System.out.println(JSONML.toJSONArray(xml, false));
System.out.println(JSONML.toJSONArray(xml, true));

Output:

["p",{"title":"<"},"<"]
["p",{"title":"&lt;"},"<"]

The second result should also contain "<" as its text node. Enabling keepStrings should affect type conversion, not the text itself. toJSONObject(xml, true) has the same behavior, and converting the result back to XML changes the original text.

XMLTokener.nextContent() already decodes entities, but the keepStrings branch in JSONML.parse() calls XML.unescape() again. This looks like a remaining case from #362, which removed the extra decoding for JSONML attributes and the XML conversion paths.