The enforcement is an app-level issue, depending on the semantics of the field. I agree it doesn't belong in the low-level transport protocol.

The rules for "username", "display name", "biography", "email address", "email body" and "contents of uploaded file with name foo.txt" are not all going to be the same.

Can a regular expression be used to restrict Unicode chars like the ones described?

I’m imagining a listing of regex rules for the various gotchas, and then a validation-level use that unions the ones you want.