str: utf8 encoder allows encoding invalid code points

[thestinger]

The highest valid code point is 1114111 (0x10FFFF) and the modern UTF-8
standard guarantees that the maximum number of bytes needed to encode a
code point is 4 (instead of 6, in the legacy standard).

From https://tools.ietf.org/html/rfc3629:

Changes from RFC 2279

o Restricted the range of characters to 0000-10FFFF (the UTF-16
accessible range).

[thestinger]

Nominating this for the backwards compatible milestone. A simple attempted fix breaks a test in the json module so we have at least a bit of code depending on this incorrect behaviour.

#5151 (the failed pull request) has more details

[bluss]

See also issue #3787

[thestinger]

Fixed.