utf8: check for non-shortest form using known valid code points

http://www.unicode.org/versions/corrigendum1.html

We need to check that the non-shortest form of the UTF-8 is being used
when validating UTF-8. Higher level languages should be doing this when
they convert to their native string type, but we need it in C as well.

The two-byte representation for NULL is allowed (modified-utf8).