Unicode escapes must be scalar values

Code points was not precise enough.
Explicitly disallow the JSON UTF-16 hack would cause portability issues.