Regex: Do not allow private use codepoints literals

We use them to encode non-literals in lookarounds, so they can
trigger bugs.

Fixes #1737

src/regex_impl.cc

@@ -292,7 +292,7 @@ private:
             case '|': case ')':
                 return {};
             default:
-                if (contains("^$.*+?[]{}", cp))
+                if (contains("^$.*+?[]{}", cp) or (cp >= 0xF0000 and cp <= 0xFFFFF))
                     parse_error(format("unexpected '{}'", cp));
                 ++m_pos;
                 return new_node(ParsedRegex::Literal, cp);